CVE-2026-68555: Coturn TURN Server DoS Vulnerability

CVE-2026-68555 Overview

CVE-2026-68555 is a resource exhaustion vulnerability [CWE-400] in Coturn, a widely deployed open-source implementation of TURN and STUN servers. The flaw affects Coturn version 4.15.0 when the server enables the --mobility option to support RFC 8016 handoffs. An authenticated TURN user can repeatedly resume a single allocation from new UDP 5-tuples without completing the handoff, accumulating orphaned server-side sessions. The pending resume tracking in mobile_begin_transition() overwrites its single link on each resume, leaving earlier pending sessions unreachable by the cleanup path. The issue is fixed in Coturn 4.16.0.

Critical Impact
A single authenticated attacker can exhaust Coturn process memory and cause denial of service even when --user-quota=1 is enforced.

Affected Products

Coturn 4.15.0 with --mobility enabled
TURN/STUN deployments supporting RFC 8016 mobility handoffs
WebRTC infrastructure relying on Coturn for media relay

Discovery Timeline

2026-08-19 - CVE-2026-68555 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68555

Vulnerability Analysis

Coturn implements RFC 8016 mobility handoffs to let clients migrate an existing TURN allocation between network paths. The mobility state machine tracks pending resumes so the server can complete or abort a handoff. In version 4.15.0, this tracking uses a single link field per allocation, which is silently overwritten on each new resume.

The defect combines two mistakes. First, mobile_begin_transition() in src/server/ns_turn_server.c disarms the incoming session's allocation timeout and overwrites the allocation's mobile_pending_resume pointer. Earlier pending sessions become unreachable by the cleanup path and are never freed. Second, copy_auth_parameters() ignores failures from inc_quota(), so the per-user quota check is bypassed for resumed sessions.

An attacker with valid TURN credentials can therefore accumulate an unbounded number of live server-side sessions by chaining resume requests from fresh UDP 5-tuples. Memory usage grows without limit until the Coturn process is killed.

Root Cause

The root cause is a resource management defect [CWE-400]. The allocation state stores only one pending resume reference, and the mobility transition code neither closes the previous pending session nor propagates quota errors. Together, these gaps break the invariant that a user may hold no more than --user-quota allocations.

Attack Vector

Exploitation requires an authenticated TURN user account and a server started with --mobility. The attacker sends an Allocate followed by successive Refresh requests from different source ports, satisfying authentication but never issuing a Send or ChannelData on the new path to complete the handoff. Each accepted resume creates a new orphan session that the fixed code path would tear down.

python

#!/usr/bin/env python3
# Chained-mobility-resume load driver for the RFC 8016 handoff regression test
# (see examples/run_tests_mobility_resume_flood.sh).
#
# Allocates one mobility-enabled TURN allocation, then repeatedly resumes it
# from fresh UDP 5-tuples WITHOUT ever completing a handoff (it never sends a
# Send/ChannelData on the new path). Each accepted resume opens a new pending
# transition. A server that does not bound pending resumes per allocation
# accumulates one orphaned server-side session per resume; a fixed server tears
# down the superseded pending on every subsequent resume, so the live session
# count stays bounded.

import hashlib
import hmac
import os
import socket
import struct
import sys

MAGIC = 0x2112A442
M_ALLOCATE = 0x0003
M_REFRESH = 0x0004
ALLOCATE_OK = 0x0103
REFRESH_OK = 0x0104

A_USERNAME = 0x0006
A_MI = 0x0008

Source: Coturn commit a97f192 - proof-of-concept load driver included with the fix.

Detection Methods for CVE-2026-68555

Indicators of Compromise

Rapid growth in Coturn resident memory (RSS) without a corresponding rise in unique authenticated users.
Large volume of TURN Refresh or Allocate requests from a single username originating from many different source ports.
Coturn log entries showing repeated mobile_begin_transition events for the same allocation.
Out-of-memory kills or crashes of the turnserver process after mobility traffic bursts.

Detection Strategies

Monitor Coturn process memory and open-session counts as time-series metrics, and alert on divergence from the authenticated user count.
Enable Coturn verbose logging and search for repeated resume attempts per allocation ID.
Correlate TURN authentication logs with source-port entropy per user to identify anomalous 5-tuple churn.

Monitoring Recommendations

Export turnserver metrics via CLI status commands or a sidecar and ingest them into a centralized data lake.
Track UDP flow counts per authenticated principal to detect the resume-flood pattern.
Alert on sudden increases in allocation-timeout disarms if telemetry is available.

How to Mitigate CVE-2026-68555

Immediate Actions Required

Upgrade Coturn to version 4.16.0 or later on all TURN/STUN servers.
If patching is not immediately possible, remove --mobility from the Coturn configuration to disable the vulnerable code path.
Rotate TURN shared secrets and long-term credentials if abuse is suspected.
Restrict TURN account provisioning and enforce short credential lifetimes.

Patch Information

The fix is included in Coturn 4.16.0, released via the GitHub Release Note 4.16.0. The upstream fix in GitHub Commit a97f192 tears down superseded pending sessions on every subsequent resume and honors inc_quota() failures. Full technical detail is available in the GitHub Security Advisory GHSA-hpq3-g7x4-h7xx.

Workarounds

Disable the --mobility flag until the server is upgraded to 4.16.0.
Set aggressive process memory limits with systemd MemoryMax= or cgroups to bound the blast radius.
Rate-limit TURN authentication attempts and new UDP flows per source credential using a front-end firewall.

bash

# Configuration example: disable mobility as a temporary workaround
# /etc/turnserver.conf
# mobility          # <-- comment out or remove this line
user-quota=1
total-quota=100

# Enforce process memory ceiling via systemd override
# /etc/systemd/system/coturn.service.d/limits.conf
[Service]
MemoryMax=1G
Restart=on-failure