CVE-2026-68555: coturn: Chained mobility resumes allow authenticated remote memory exhaustion
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition() in src/server/nsturnserver.c disarms each new session's allocation timeout and overwrites the allocation's single mobilependingresume link, leaving earlier pending sessions unreachable by the cleanup path, while copyauthparameters() ignores incquota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.16.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Coturn 4.15.0 deployments that enable the --mobility option are exposed. Exploitation requires an authenticated TURN user; the issue affects UDP mobility-resume handling.
Does --user-quota=1 prevent exploitation?
No. The described flaw can retain unbounded server-side sessions even when --user-quota=1 is configured, because quota-increment failures are ignored during the affected flow.
What does an attacker need to do?
An attacker needs valid TURN authentication and must repeatedly resume a single allocation from fresh UDP 5-tuples without completing the handoff. No user interaction is required.
What is the remediation?
Upgrade Coturn to version 4.16.0, which fixes the issue. If upgrading is not immediately possible, disabling --mobility removes the affected feature path.