CVE-2026-73215 coturn CVE debrief

Who should care

Coturn administrators and users should assess exposure and prioritize patching to prevent authenticated clients from exhausting the relay port pool. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, checking relevant monitoring, detection, and logs for exposed assets that need extra review, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is verified

Why it matters

CVE-2026-73215 is a high-severity vulnerability in Coturn that allows authenticated clients to exhaust the relay port pool. Defenders should prioritize patching Coturn installations to prevent this issue.

• Authenticated clients can permanently exhaust the relay port pool
• Subsequent allocations will fail with STUN error 508
• Patching to version 4.17.0 or later is required to fix the issue

Technical summary

The vulnerability is caused by the turnports_allocate_even() function in src/apps/relay/turn_ports.c marking the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0. This issue allows an authenticated client to permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508. The vulnerability is fixed in version 4.17.0. Coturn administrators and users should assess exposure and prioritize patching to prevent authenticated clients from exhausting the relay port pool.

Defensive priority

Defenders should prioritize patching Coturn installations to prevent authenticated clients from exhausting the relay port pool.

Recommended defensive actions

• Patch Coturn installations to version 4.17.0 or later
• Verify Coturn installations for exposure
• Monitor Coturn relay port pool usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the turnports_allocate_even() function in src/apps/relay/turn_ports.c marking the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0. This issue allows an authenticated client to permanently exhaust the relay port pool.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.