CVE-2026-73215
Description
A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port pool. Consequently, new connection allocations will fail, resulting in a Denial of Service (DoS) for legitimate users.
Statement
This Moderate impact flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. It allows an authenticated client to cause a denial of service. By sending a crafted port allocation request, an attacker can permanently exhaust the server's relay port pool, preventing new connections.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Upgrade to coturn 4.17.0.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
