CVE-2026-73215: Coturn TURN/STUN Server DoS Vulnerability

CVE-2026-73215 Overview

Coturn is a widely deployed open source implementation of the Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) protocols. Versions prior to 4.17.0 contain a resource exhaustion flaw in the turnports_allocate_even() function located in src/apps/relay/turn_ports.c. The function marks the unused odd sibling port as TPS_TAKEN_ODD when processing an EVEN-PORT Allocate request with reservation bit R=0, even though no Real-time Transport Control Protocol (RTCP) socket exists to release it. An authenticated client can repeat this request to permanently exhaust the relay port pool. Subsequent allocations then fail with STUN error 508.

Critical Impact
Authenticated clients can permanently drain the Coturn relay port pool, denying TURN service to all downstream WebRTC and Voice over IP (VoIP) users.

Affected Products

Coturn TURN/STUN server versions prior to 4.17.0
WebRTC deployments relying on Coturn relay services
VoIP and video conferencing platforms using Coturn as media relay

Discovery Timeline

2026-08-11 - CVE-2026-73215 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73215

Vulnerability Analysis

The Coturn relay maintains a pool of User Datagram Protocol (UDP) ports for TURN allocations. When a client submits an Allocate request with the EVEN-PORT attribute, the server reserves an even-numbered port and, if the reservation bit R=1, also reserves the adjacent odd port for RTCP media. The reserved odd port is later released when the associated RTCP socket closes.

The defect appears when the reservation bit R=0. The turnports_allocate_even() function still marks the odd sibling port with the TPS_TAKEN_ODD state, but no RTCP socket is created to eventually free it. Each request permanently removes one port from the pool. This is classified as an uncontrolled resource consumption weakness under [CWE-400].

Root Cause

The root cause is incorrect state handling of the allocate_rtcp parameter. The function ignored the parameter and unconditionally tagged the odd sibling port as taken, regardless of whether an RTCP socket would ever release it. The upstream fix removes the UNUSED_ARG(allocate_rtcp) macro and honors the parameter when marking sibling ports.

Attack Vector

An authenticated TURN client sends repeated Allocate requests carrying the EVEN-PORT attribute with reservation bit R=0. Each request consumes one odd port from the shared relay pool without providing a release path. Once the pool is drained, all subsequent Allocate requests from any user return STUN error code 508 (Insufficient Capacity), producing a service-wide denial of service condition.

// Patch to src/apps/relay/turn_ports.c (4.17.0)
 int turnports_allocate_even(turnports *tp, int allocate_rtcp, uint64_t *reservation_token) {
-  UNUSED_ARG(allocate_rtcp);
-
   if (tp) {
     TURN_MUTEX_LOCK(&tp->mutex);
     const uint16_t size = turnports_size(tp);
// Source: https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2

The patch begins honoring the allocate_rtcp argument so the odd sibling port is only reserved when an RTCP socket will exist to release it. See the GitHub commit for the complete fix.

Detection Methods for CVE-2026-73215

Indicators of Compromise

Repeated TURN Allocate requests from a single authenticated principal carrying the EVEN-PORT attribute with reservation bit R=0.
Rising counts of STUN error 508 (Insufficient Capacity) responses returned to legitimate clients.
Steady decline in available relay ports without a matching increase in active TURN sessions.

Detection Strategies

Baseline the ratio of EVEN-PORT Allocate requests to standard Allocate requests per authenticated user and alert on statistical outliers.
Correlate Coturn logs with connection tracking data to identify accounts that allocate but never release relay endpoints.
Track relay port utilization as a time-series metric and flag monotonic increases that never recede.

Monitoring Recommendations

Export Coturn syslog and metrics into a central Security Information and Event Management (SIEM) system for behavioral analysis.
Alert on any occurrence of STUN error 508 in production, as it directly indicates pool exhaustion.
Monitor authenticated user Allocate rates and enforce per-user rate limits at the application or network layer.

How to Mitigate CVE-2026-73215

Immediate Actions Required

Upgrade Coturn to version 4.17.0 or later on all TURN/STUN relay hosts.
Audit TURN authentication credentials and rotate long-lived shared secrets used with the use-auth-secret mechanism.
Restrict TURN access to authenticated tenants only and remove any anonymous or guest allocation paths.

Patch Information

The fix is included in Coturn 4.17.0. Details are documented in the GHSA-847g-qmc6-6m4r advisory. Administrators should validate that the deployed binary reports version 4.17.0 or higher after upgrade.

Workarounds

Apply strict per-user Allocate request rate limits using Coturn user-quota and total-quota directives until the upgrade is deployed.
Reduce the impact window by restarting the turnserver process on a schedule to reclaim leaked port state.
Segment TURN infrastructure so a single tenant cannot exhaust ports shared by other tenants.

bash

# /etc/turnserver.conf - defensive quotas until patched to 4.17.0
user-quota=10
total-quota=1200
min-port=49152
max-port=65535