High severity · published Aug 11, 2026
CVE-2026-73215
The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
coturn · coturn
< 4.17.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73215
github.com
https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2
github.com
https://github.com/coturn/coturn/releases/tag/4.17.0
github.com
https://github.com/coturn/coturn/security/advisories/GHSA-847g-qmc6-6m4r
More from coturn
9.8
CVE-2026-43994
Coturn: Stack buffer overflow in decode_oauth_token_gcm()
8.2
CVE-2026-73214
coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
8.2
CVE-2026-62959
Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)
7.7
CVE-2025-69217
Coturn has unsafe nonce and relay port randomization due to weak random number generation.
7.5
CVE-2026-40613
Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)