CVE-2026-73213: Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addrlesseq() in src/client/nsturnioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioaaddrinrange(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73213?
CVE-2026-73213 has a risk rating of 47.
How do I fix CVE-2026-73213?
To fix CVE-2026-73213, upgrade Coturn to version 4.16.0 or later.
What does CVE-2026-73213 affect?
CVE-2026-73213 affects the Coturn software, specifically its implementation of TURN and STUN servers.
What kind of vulnerability is CVE-2026-73213?
CVE-2026-73213 is a security vulnerability that allows authenticated TURN clients to bypass specified IPv6 range restrictions.
Is CVE-2026-73213 relevant for IPv4 users?
CVE-2026-73213 specifically concerns IPv6 and does not directly affect IPv4 users.