CVE-2026-73216: coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdownclientconnection() in src/server/nsturnserver.c prematurely calls decquota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.17.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73216?
CVE-2026-73216 has a medium severity rating of 6.5.
What are the potential risks associated with CVE-2026-73216?
CVE-2026-73216 can lead to mobility disconnects that bypass allocation quotas and exhaust relay capacity.
How do I fix CVE-2026-73216?
To fix CVE-2026-73216, update Coturn to version 4.17.0 or later.
Which versions of Coturn are affected by CVE-2026-73216?
CVE-2026-73216 affects all Coturn versions prior to 4.17.0.
What functionality does CVE-2026-73216 compromise in Coturn?
CVE-2026-73216 compromises the management of bandwidth accounting during the closure of mobility-enabled allocations in Coturn.