Coturn: Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT… (CVE-2026-73215)
Description
Coturn versions prior to 4.17.0 contain a vulnerability in the turnports_allocate_even() function where an unused odd sibling port is incorrectly marked as taken during an even-port allocation request with reservation bit R=0. This flaw allows an authenticated client to exhaust the relay port pool permanently, causing subsequent port allocation requests to fail with STUN error 508. The issue is resolved in Coturn version 4.17.0.
CVSS v4.0
Affected software
pkg:deb/ubuntu/coturn?arch=source&distro=xenialpkg:deb/ubuntu/coturn?arch=source&distro=bionicpkg:deb/ubuntu/coturn?arch=source&distro=focalpkg:deb/ubuntu/coturn?arch=source&distro=jammypkg:deb/ubuntu/coturn?arch=source&distro=noblepkg:deb/ubuntu/coturn?arch=source&distro=stonkingpkg:deb/ubuntu/coturn?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Coturn, an open source TURN and STUN server implementation, has a vulnerability in versions before 4.17.0 where the turnports_allocate_even() function in src/apps/relay/turn_ports.c incorrectly marks the unused odd sibling port as TPS_TAKEN_ODD during an even-port allocation request with reservation bit R=0. Since no RTCP socket releases this port, an authenticated client can cause permanent exhaustion of the relay port pool, leading to denial of service for subsequent allocation attempts, which fail with STUN error 508. This vulnerability is fixed in version 4.17.0.
Potential Impact
An authenticated client can permanently exhaust the relay port pool by exploiting this flaw, resulting in denial of service for other clients attempting to allocate relay ports. This causes subsequent allocation requests to fail with STUN error 508, disrupting TURN/STUN server functionality.
Mitigation Recommendations
Upgrade Coturn to version 4.17.0 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-73215
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ad3f58b2cdf04f6566621bf
Added to database: 10/17/2026, 22:24:11 UTC
Last enriched: 10/17/2026, 23:47:44 UTC
Last updated: 10/17/2026, 23:47:44 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.