CVE-2026-73214 coturn CVE debrief

Who should care

Defenders responsible for Coturn server configurations and deployments should assess exposure and prioritize upgrading to version 4.16.0 or later. This includes operators managing Coturn servers, platform administrators, vulnerability management teams, and security teams responsible for reviewing and implementing security updates.

Why it matters

CVE-2026-73214 is a high-severity vulnerability in Coturn that allows an unauthenticated remote sender to exhaust memory. Defenders should prioritize upgrading to version 4.16.0 or later and review server configurations for potential exposure.

• Potential memory exhaustion leading to denial of service
• Requires verification of Coturn version and configuration
• Prioritization of upgrade to version 4.16.0 or later

Technical summary

The vulnerability allows an unauthenticated remote sender to exhaust memory by sending a specially crafted 35-byte fragmented ClientHello message, declaring a 650,000-byte handshake before cookie validation. This issue is caused by the dtls_server_input_handler() and create_new_connected_udp_socket() functions in src/apps/relay/dtls_listener.c retaining OpenSSL dtls1_reassemble_fragment() state. The vulnerability is fixed in version 4.16.0, and defenders should prioritize upgrading to this version or later to prevent potential memory exhaustion attacks.

Defensive priority

Defenders should prioritize upgrading to Coturn version 4.16.0 or later to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Upgrade to Coturn version 4.16.0 or later
• Review and monitor Coturn server configurations for potential exposure
• Implement additional security measures to prevent memory exhaustion attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the dtls_server_input_handler() and create_new_connected_udp_socket() functions in src/apps/relay/dtls_listener.c retaining OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.