Insufficient Port Allocation in Coturn Affects Relay Server Functionality

CVE-2026-73215

What is CVE-2026-73215?

Coturn, the open-source TURN and STUN server, exhibits a vulnerability related to the management of relay ports. Specifically, the function turnports_allocate_even() fails to properly release unused odd sibling ports marked as TPS_TAKEN_ODD for an EVEN-PORT Allocate request when the reservation bit R=0 is set. This oversight allows an authenticated user to exhaust the pool of relay ports, resulting in failed subsequent allocation requests and triggering a STUN error 508. The issue has been resolved in version 4.17.0, emphasizing the crucial need for timely updates to this widely used networking tool.

References