{"id":"CVE-2026-73212","summary":"coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.","aliases":["GHSA-2x4g-wx24-48m4"],"modified":"2026-09-11T08:36:45.541595Z","published":"2026-08-11T17:31:43.961Z","related":["openSUSE-SU-2026:11617-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73212.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-284","CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.13.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73212.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-2x4g-wx24-48m4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73212"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc"},{"type":"FIX","url":"https://github.com/coturn/coturn/pull/1945"},{"type":"FIX","url":"https://github.com/coturn/coturn/pull/1947"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"cf4b4952de48510d38415b96300da5fc674bfdda"},{"fixed":"d49ee56aa9fe748af064853d5e430eec1ccc3cbc"},{"fixed":"f696c74fced6a5c05df555139e51cfce6b3e2802"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.13.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73212.json","vanir_signatures_modified":"2026-09-11T08:36:45Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["144044545338260599198113116632053069505","7148339465883900300752751605354834566","194217777750976600931697608059255056003","106678661995320731839739969210669588442"],"threshold":0.9},"id":"CVE-2026-73212-08bd3f29","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc","target":{"file":"src/server/ns_turn_server.c"}},{"target":{"file":"tests/test_ioaddr.c","function":"main"},"deprecated":false,"digest":{"function_hash":"198467360605203208723281685747105879148","length":710},"id":"CVE-2026-73212-0a07666f","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda"},{"deprecated":false,"digest":{"length":1060,"function_hash":"275411062934366136403112954012688679673"},"id":"CVE-2026-73212-14cf0590","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc","target":{"file":"tests/test_ioaddr.c","function":"main"}},{"deprecated":false,"digest":{"line_hashes":["231845268547749734859923506570142811809","93328447809025428638579479010601090610","310983623423119537528838843870811311442","8567001965666574673905331775927043985","232895132753571416521742968925417046331","242970148054073517503536024996794830206","92932165966170216058717651854032456382","100549025137796857742718556045935255631","106146356491434805232521002955025492303","35868905053095208166130349001413809353","201430485139780064012631053888737544172","29186316876286775703334839929301948538","146365534533010756486321660037579158131","261415759950214912580456461030324003968","328229849245042859960723634910714417444","47533685617045507019554978102902179825","79031368299208363065900501424797693022","32027773395356315815698922316369793558","268677261783066883655271510289671886209","23035565974460601582007217483560531767","17695763211657480235128609770701565516","65281553999759924704715056143105730158","89965137571467684514311411315314847973","107073750223578926905403376800219888733","115583093538107113751843374359923672309","145174782235946091340299764001516325413","201323896808688106171494325566298221919","10101747285742613244093701589247280562","119364723841867062746303414758710267683","198505625127046035110651891715055347472","256322552975266024840508404376721889990","266996849340453278956531182564775370378","6807080301974336807740423311724447467","94565756595371361879396329938927468913","307418082343887439285027088670875692366","256682302824954597806939344752801210214","116428322841099359976108842002603783435","148657917596857223561210742477537820564","18241772197660393362744770360675203938","202505009707059628979706328332002955608","268038016772748850803691701167009146771","119594422018000296140634679510125597043","44594492717051067512330329410817014586","5058953202058253860536145475666501182","81931692230316830795078206657339622666","177194212389401238167643088782693816980","143161306463000959728003866272967310702","68630939616778103177188740956152931463","103209455738584986819839160808118498936","99451377433655794018633471570645083470","79320272210584344500052932796045833857","109088451656471905639205527166513447584","57826210874374045830754921082802307077","96070293587630998257326716649739859398","31076393714998640146350507487475402391","79256649503694984882418547198140658640"],"threshold":0.9},"id":"CVE-2026-73212-2811a598","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda","target":{"file":"src/client/ns_turn_ioaddr.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda","target":{"file":"src/client/ns_turn_ioaddr.c","function":"ioa_addr_is_loopback"},"deprecated":false,"digest":{"function_hash":"106959670199216232202092369075248787839","length":544},"id":"CVE-2026-73212-2cd5e70b"},{"deprecated":false,"digest":{"line_hashes":["273732613924503932469411135565560529435","301199205749693446978984604816243396019","144427543266647235593672486732027598212","50314329637837264821889737395088913491"],"threshold":0.9},"id":"CVE-2026-73212-384384f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc","target":{"file":"src/client/ns_turn_ioaddr.h"}},{"deprecated":false,"digest":{"line_hashes":["169973713728298437936014722245402819990","268385381143081086792170283978431198512","310352832323857239197718622195920949974","111692991681024890751417999694402280577","196386566215050067300581479588547534883","212793816677128781745505377528243233657"],"threshold":0.9},"id":"CVE-2026-73212-4060fcb8","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda","target":{"file":"tests/test_ioaddr.c"}},{"deprecated":false,"digest":{"length":448,"function_hash":"200592091559670493766309036252197552385"},"id":"CVE-2026-73212-42f365ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda","target":{"file":"src/client/ns_turn_ioaddr.c","function":"ioa_addr_is_multicast"}},{"id":"CVE-2026-73212-525adcfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda","target":{"file":"src/client/ns_turn_ioaddr.h"},"deprecated":false,"digest":{"line_hashes":["55606295847433098034840009046217933004","296849415753679227564017088546233471130","235735912907085649180709437546252041531","121420556583371237221318256895813248202","157841318376202038880259683006455433743"],"threshold":0.9}},{"target":{"file":"src/client/ns_turn_ioaddr.c","function":"ioa_addr_in_range"},"deprecated":false,"digest":{"function_hash":"45351566854461191350199241582286227894","length":733},"id":"CVE-2026-73212-ab4d48c3","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc","target":{"file":"src/server/ns_turn_server.c","function":"good_peer_addr"},"deprecated":false,"digest":{"function_hash":"292503820364436671972078477740557628331","length":2191},"id":"CVE-2026-73212-b7cc474b"},{"target":{"file":"src/client/ns_turn_ioaddr.c","function":"ioa_addr_is_zero"},"deprecated":false,"digest":{"function_hash":"26544299712436691186354389100416881424","length":571},"id":"CVE-2026-73212-be5ceb3a","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc","target":{"file":"tests/test_ioaddr.c"},"deprecated":false,"digest":{"line_hashes":["120428646982814466286826289135605018035","252594688358614542525625560173692176747","310352832323857239197718622195920949974","330615255684824283155325802543463521461","44208206234267140669076169553044684653","121772199164123787054016213592730105162"],"threshold":0.9},"id":"CVE-2026-73212-d87a0e38"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}