CVE-2026-68555

Received Received - Intake

Authenticated TURN Allocation Memory Exhaustion in Coturn

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-68555

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	to 4.16.0 (exc)
coturn	coturn	4.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-68555 is a vulnerability in Coturn, a TURN and STUN server. An authenticated user can exploit it to create unbounded server-side sessions by repeatedly resuming allocations without completing handoffs. This exhausts process memory even when user quotas are set.

Detection Guidance

Detecting this vulnerability requires checking the Coturn server version and monitoring for unusual session activity. Run 'turnserver --version' to verify if your version is below 4.16.0. Check server logs for repeated allocation resumes from the same user, which may indicate exploitation attempts.

Impact Analysis

The vulnerability allows attackers to consume excessive server resources, leading to denial-of-service conditions. It can degrade server performance or crash the service entirely, disrupting legitimate users.

Compliance Impact

The vulnerability allows an authenticated attacker to exhaust server resources by creating unbounded sessions, which could lead to denial-of-service conditions. This may impact compliance with GDPR by disrupting availability of services processing personal data and HIPAA by affecting the availability of systems handling protected health information.

Mitigation Strategies

Upgrade Coturn to version 4.16.0 or later immediately. If upgrading is not possible, disable the --mobility feature in your Coturn configuration. Additionally, enforce strict user quotas and monitor server memory usage for signs of session exhaustion.

Hi! I’m here to help you understand CVE-2026-68555. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70