CVE-2026-73215
Last modified
CVE-2026-73215 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508.
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| coturn | coturn | < 4.17.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-73215?
How severe is CVE-2026-73215?
How do I fix CVE-2026-73215?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7321Sandbox escape due to incorrect boundary conditions in the W…9.6
- CVE-2026-73210A Server-Side Request Forgery (SSRF) vulnerability existed i…5.1
- CVE-2026-73211PeerTube is an ActivityPub-federated video streaming platfor…9.8
- CVE-2026-73212Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73213Coturn is a free open source implementation of TURN and STUN…5.8
- CVE-2026-73214Coturn is a free open source implementation of TURN and STUN…8.2
- CVE-2026-73216Coturn is a free open source implementation of TURN and STUN…6.5
- CVE-2026-73217Cursor is a code editor built for programming with AI. Prior…7.7
- CVE-2026-73218Cursor is a code editor built for programming with AI. Prior…7.7
- CVE-2026-73219CVAT is an open source interactive video and image annotatio…5.3
- CVE-2026-7322Memory safety bugs present in Thunderbird ESR 140.10.0 and T…7.3
- CVE-2026-73221CVAT is an open source interactive video and image annotatio…5.3
Are you affected by CVE-2026-73215?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST