CVE-2026-73214: coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler() and createnewconnectedudpsocket() in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73214?
CVE-2026-73214 has a risk score of 64, indicating it's a medium severity vulnerability.
How do I fix CVE-2026-73214?
To address CVE-2026-73214, upgrade to Coturn version 4.16.0 or later, which includes the necessary patches.
What are the potential impacts of CVE-2026-73214?
CVE-2026-73214 allows for source-spoofing and potential botnet state-exhaustion Denial of Service attacks.
Which versions of Coturn are affected by CVE-2026-73214?
CVE-2026-73214 affects Coturn versions prior to 4.16.0.
What components of Coturn are vulnerable in CVE-2026-73214?
The dtls_server_input_handler() and create_new_connected_udp_socket() functions in Coturn are the components exploited in CVE-2026-73214.