CVE-2026-73213
Description
A flaw was found in Coturn. An authenticated TURN client can bypass configured IP address restrictions due to an incorrect component-wise IPv6 comparison in the addr_less_eq() function. This allows the client to relay traffic to an IPv6 peer that should be denied, leading to a Server-Side Request Forgery (SSRF) vulnerability.
Statement
Red Hat products do not ship Coturn. The community packages (Fedora, EPEL) ship Coturn 4.16.0 which includes the fix for this vulnerability.
Mitigation
Update Coturn to version 4.16.0 or later, which replaces the incorrect component-wise IPv6 comparison with a correct memcmp-based ordering.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Access Control
Technical Impact: Bypass Protection Mechanism
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
