CVE-2026-73216

MEDIUM 6.5

coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.

CWE	CWE-400
Vendor	coturn
Product	coturn
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for coturn coturn

Be the first to know when new medium vulnerabilities affecting coturn coturn are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

coturn / coturn

< 4.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq github.com: https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b github.com: https://github.com/coturn/coturn/releases/tag/4.17.0