CVE-2026-73216

Received Received - Intake

Relay Port Exhaustion in Coturn Server

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73216

EUVD

EUVD-2026-56825

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	to 4.17.0 (exc)
coturn	coturn	4.17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-73216 is a vulnerability in the Coturn TURN server where an authenticated client can bypass user and total allocation quotas when the --mobility feature is enabled. The issue occurs because the server releases quota and bandwidth reservation during the first-stage close of a mobility-enabled allocation while keeping the allocation and relay socket alive. This allows an attacker to repeatedly create allocations, exhaust relay ports, and bypass configured quotas until the relay port pool is full.

Detection Guidance

To detect this vulnerability, check if your Coturn server is running a version prior to 4.17.0 with the --mobility flag enabled. Monitor for excessive allocation attempts or relay port exhaustion errors (508). Use logs to identify repeated allocation and disconnection cycles by authenticated clients.

Impact Analysis

This vulnerability allows an authenticated attacker to exhaust relay ports on the Coturn server by creating multiple mobility-enabled allocations and disconnecting repeatedly. This can lead to denial of service as legitimate users cannot establish new connections once the relay port pool is exhausted. The attack requires the --mobility option to be enabled and does not affect non-mobility allocations.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. Exhausting relay ports may lead to service unavailability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312). However, the primary issue is resource exhaustion rather than direct data exposure.

Mitigation Strategies

Upgrade Coturn to version 4.17.0 or later immediately. Disable the --mobility flag if not required. Implement strict quotas and monitor relay port usage. Block or rate-limit clients exhibiting suspicious allocation patterns.

Hi! I’m here to help you understand CVE-2026-73216. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70