CVE-2026-73215 in Coturn
Summary
by MITRE • 08/11/2026
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the coturn TURN and STUN server implementation where a flaw in port allocation handling creates a persistent resource exhaustion condition. This issue affects versions prior to 4.17.0 and specifically targets the turnports_allocate_even() function located in src/apps/relay/turn_ports.c. The problem manifests when processing EVEN-PORT Allocate requests with the reservation bit R=0, where the system incorrectly marks unused odd sibling ports as TPS_TAKEN_ODD state. This misclassification occurs because the implementation fails to properly account for the fact that no RTCP socket will ever release these marked ports, creating a permanent allocation conflict.
The technical flaw represents a denial of service vulnerability that operates through improper resource management within the relay port allocation system. When an authenticated client submits an EVEN-PORT Allocate request with R=0, the server erroneously reserves both the requested even port and its sibling odd port, marking the odd port as TPS_TAKEN_ODD despite no mechanism existing to release it later. This behavior violates proper resource lifecycle management principles where allocated resources should be freed when no longer needed or when their associated socket connections terminate.
The operational impact of this vulnerability is significant as it allows authenticated clients to systematically consume all available relay ports in the pool, ultimately leading to service disruption for legitimate users. Once the port pool becomes exhausted, subsequent allocation requests fail with STUN error 508, which indicates a server overload condition and prevents new TURN sessions from establishing successfully. This creates a persistent denial of service scenario where malicious or compromised clients can indefinitely exhaust server resources without requiring additional authentication credentials beyond initial access.
The vulnerability aligns with CWE-400 (Uncontrolled Resource Consumption) and CWE-617 (Reachable Assertion) categories, representing a classic resource exhaustion attack vector that affects network services. From an ATT&CK framework perspective, this maps to T1499.004 (Endpoint Denial of Service) and potentially T1566.002 (Phishing via Service) if the service disruption impacts legitimate user access. The flaw demonstrates poor resource management practices where port allocation state transitions do not properly consider the lifecycle of associated network sockets and connection handling mechanisms.
Mitigation strategies should focus on upgrading to coturn version 4.17.0 or later, which implements proper port allocation logic that correctly handles odd sibling port marking for EVEN-PORT requests. Network administrators should also consider implementing rate limiting and connection monitoring to detect abnormal port consumption patterns, while maintaining appropriate logging of allocation events to identify potential exploitation attempts. Additionally, system administrators should review and test the updated implementation thoroughly before deployment to ensure no regressions in legitimate service functionality occur during the upgrade process.