CVE-2026-68555 coturn CVE debrief

Who should care

Coturn users and administrators, especially those enabling --mobility, should be aware of this vulnerability and take necessary actions to upgrade or mitigate the risk. This includes reviewing and adjusting user quotas and session timeouts, as well as implementing compensating controls to monitor and limit user sessions. Additionally, operators, platform administrators, and security teams should review the vulnerability's impact on their systems and take appropriate measures to protect against potential attacks. Those responsible for vulnerability management and security operations should prioritize patching or mitigating this vulnerability to prevent potential memory exhaustion attacks. Security teams should also review monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and change management processes should be updated to account for this vulnerability. Those tracking exceptions and remediation efforts should ensure that affected systems are properly documented and verified as remediated before closing the item. Finally, source tracking and incident response processes should be prepared to handle potential exploitation attempts related to this vulnerability. Coturn users with --mobility enabled are at highest risk and should take immediate action to protect their systems. Users of Coturn versions prior to 4.16.0 are also at risk and should upgrade or apply mitigations as soon as possible. Security teams should prioritize communication with Coturn administrators and operators to ensure prompt remediation of this vulnerability. Those managing Coturn installations should verify that their systems are not exposed to excessive session retention and take steps to limit the impact of potential attacks. By taking these steps, Coturn users and administrators can reduce the risk of memory exhaustion and other potential attacks related to this vulnerability. Coturn deployments with limited user quotas may be particularly vulnerable and should be prioritized for patching or mitigation. Those responsible for Coturn installations should also review their system's configuration and ensure that it is properly secured against potential 5G

Technical summary

In Coturn version 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. The mobile_begin_transition() function disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path. This issue allows an attacker to retain unbounded server-side sessions and exhaust process memory.

Defensive priority

Authenticated users with limited privileges can cause unbounded session retention, leading to process memory exhaustion.

Recommended defensive actions

• Inventory Coturn installations and verify if --mobility is enabled.
• Upgrade to Coturn version 4.16.0 or later.
• Implement compensating controls to monitor and limit user sessions.
• Review and adjust user quotas and session timeouts.
• Review monitoring, detection, and logs for exposed assets that need extra review.
• Asset inventory and change management processes should be updated to account for this vulnerability.
• Those tracking exceptions and remediation efforts should ensure that affected systems are properly documented and verified as remediated before closing the item.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Coturn version 4.15.0. An authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. This issue allows an attacker to retain unbounded server-side sessions and exhaust process memory. To verify, defenders should check Coturn installations, review user quotas and session timeouts, and monitor for suspicious activity.

Official resources