CVE-2026-73214

Received Received - Intake

Memory Exhaustion in Coturn TURN/STUN Server

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73214

EUVD

EUVD-2026-56820

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	4.16.0
coturn	coturn	to 4.16.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-73214 is a denial-of-service (DoS) vulnerability in Coturn's DTLS listener. Before version 4.16.0, the server allocated memory for DTLS handshake state before validating client cookies. Attackers could send fragmented ClientHello messages with large declared handshake sizes but minimal data, causing memory exhaustion without credentials or completed handshakes.

Detection Guidance

Monitor for unusual memory consumption or high CPU usage on the Coturn server, particularly during DTLS handshake attempts. Check logs for fragmented ClientHello messages or repeated handshake attempts from the same or different UDP ports. Use tools like netstat or ss to observe active DTLS connections and their state.

Impact Analysis

This vulnerability allows unauthenticated attackers to crash Coturn servers by consuming all available memory. Systems using DTLS in Coturn versions before 4.16.0 are vulnerable. The attack requires no valid credentials or response processing, making it easy to execute remotely.

Compliance Impact

This vulnerability primarily impacts system availability due to memory exhaustion, which could lead to service outages. GDPR and HIPAA require maintaining availability of critical systems, so prolonged outages may violate compliance. However, the vulnerability does not directly expose or leak data, so it does not inherently violate confidentiality requirements of these standards.

Mitigation Strategies

Upgrade Coturn to version 4.16.0 or later to apply the fix. If upgrading is not immediately possible, disable DTLS if not required, implement rate-limiting for handshake attempts, reduce handshake timeouts, and enforce memory limits on the server.

Hi! I’m here to help you understand CVE-2026-73214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70