CVE-2026-73215 HIGH

CVE-2026-73215: The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

Vendor Coturn

Product coturn

Weakness CWE-400

Published August 11, 2026

Last update August 11, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.

Key dates

02Disclosure timeline

August 11, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-73215 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html AskarLabs — CWE-400 write-up Uncontrolled Resource Consumption

Related vulnerabilities

CVE-2026-73215: The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

01Description

02Disclosure timeline

03References

04Related CVE