CVE-2026-73216 coturn CVE debrief

Who should care

System administrators and security teams responsible for Coturn installations, especially those using mobility-enabled allocations, should assess their exposure and ensure timely remediation.

Why it matters

CVE-2026-73216 is a medium-severity vulnerability in Coturn that allows authenticated clients to bypass quotas, potentially leading to relay port exhaustion. Defenders should prioritize verifying Coturn installations and ensuring they are updated to version 4.17.0 or later.

• Potential relay port exhaustion due to quota bypass.
• Need to verify Coturn installations and configurations.
• Possible impact on TURN and STUN services.

Technical summary

The vulnerability in Coturn allows an authenticated client to bypass --user-quota and --total-quota settings, potentially leading to relay port exhaustion. This issue was fixed in Coturn version 4.17.0. The vulnerability arises from the premature call to dec_quota() and release of bandwidth accounting during the first-stage close of a mobility-enabled allocation. This allows attackers to exploit the system by exhausting relay ports, which can disrupt TURN and STUN services. Defenders should prioritize verifying Coturn installations, especially those with mobility-enabled allocations, and ensure they are updated to version 4.17.0 or later.

Defensive priority

Defenders should prioritize verifying Coturn installations, especially those with mobility-enabled allocations, and ensure they are updated to version 4.17.0 or later.

Recommended defensive actions

• Verify Coturn installations and ensure they are updated to version 4.17.0 or later.
• Review Coturn configurations to ensure proper quota settings.
• Monitor Coturn server logs for potential quota bypass attempts.
• Perform a thorough review of network configurations and mobility-enabled allocations.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.
• Close the item only after evidence of successful remediation is documented.

Evidence notes

The vulnerability details are based on information from the CVE Program and the National Vulnerability Database (NVD). The issue is described in the official CVE record and NVD vulnerability detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.