CVE-2026-73215: The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven() in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73215?
CVE-2026-73215 has a risk score of 33, indicating a moderate severity vulnerability.
How do I fix CVE-2026-73215?
To resolve CVE-2026-73215, update Coturn to version 4.17.0 or later.
What impact does CVE-2026-73215 have on Coturn server functionality?
CVE-2026-73215 can cause the Coturn server to stop accepting requests when 'even-port' is enabled.
Is there a workaround for CVE-2026-73215 if I cannot update immediately?
There are no known effective workarounds for CVE-2026-73215, therefore upgrading is recommended.
When was CVE-2026-73215 published?
CVE-2026-73215 was published on August 11, 2026.