Coturn: Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in… (CVE-2026-73213)
Description
Coturn versions prior to 4.16.0 contain a vulnerability in the addr_less_eq() function in src/client/ns_turn_ioaddr.c. The function uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), which allows an authenticated TURN client to relay to an IPv6 peer that should be denied by configured non-prefix-aligned denied-peer-ip ranges. This issue is fixed in version 4.16.0.
CVSS v4.0
Affected software
pkg:deb/ubuntu/coturn?arch=source&distro=xenialpkg:deb/ubuntu/coturn?arch=source&distro=bionicpkg:deb/ubuntu/coturn?arch=source&distro=focalpkg:deb/ubuntu/coturn?arch=source&distro=jammypkg:deb/ubuntu/coturn?arch=source&distro=noblepkg:deb/ubuntu/coturn?arch=source&distro=stonkingpkg:deb/ubuntu/coturn?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Coturn, an open source TURN and STUN server implementation, has a vulnerability identified as CVE-2026-73213 affecting versions prior to 4.16.0. The vulnerability arises from the addr_less_eq() function performing a component-wise comparison for IPv6 min-max intervals, causing incorrect classification of IPv6 addresses within non-prefix-aligned denied-peer-ip ranges. This allows an authenticated TURN client to relay traffic to IPv6 peers that should be blocked by the configured deny list. The issue is resolved in Coturn version 4.16.0.
Potential Impact
An authenticated TURN client can bypass IPv6 address filtering rules that rely on non-prefix-aligned denied-peer-ip ranges, potentially relaying traffic to IPv6 peers that are intended to be blocked. This could lead to unauthorized relay of traffic to restricted IPv6 addresses. The vulnerability requires authentication and does not affect confidentiality, integrity, or availability directly.
Mitigation Recommendations
Upgrade Coturn to version 4.16.0 or later, where this issue is fixed. No other mitigations are specified or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-73213
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f58b2cdf04f6566621c1
Added to database: 10/17/2026, 22:24:11 UTC
Last enriched: 10/17/2026, 23:47:58 UTC
Last updated: 10/17/2026, 23:47:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.