{"id":"CVE-2026-73213","summary":"Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.","aliases":["GHSA-4v97-rxjj-4f99"],"modified":"2026-09-11T08:36:46.459982Z","published":"2026-08-11T17:33:12.757Z","related":["openSUSE-SU-2026:11617-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73213.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.16.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73213.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73213"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"6c13608c28a04af5d63abddd7565a0dcc4771c28"},{"fixed":"ef409b4227ca16bdd23b3e3eba38530292c20773"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.16.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["docker/4.15.0-r0","4.15.0","docker/4.14.0-r0","4.14.0","docker/4.13.1-r0","docker/4.13.0-r0","4.13.1","4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"vanir_signatures":[{"digest":{"line_hashes":["13003910456361546551274353198828230562","170571220873926324122468222440216504090","202584497022650473230188544344601680326","107323105523610947151998933456962123676","308052641228891138093877115311867280666","330615255684824283155325802543463521461","286917366050493399229549351945536360543"],"threshold":0.9},"id":"CVE-2026-73213-28dc310e","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28","target":{"file":"tests/test_ioaddr.c"},"deprecated":false},{"id":"CVE-2026-73213-5588dc44","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28","target":{"file":"src/client/ns_turn_ioaddr.c"},"deprecated":false,"digest":{"line_hashes":["120560996744269810542235267652752672867","308464990571648349526301640883181461714","46167370824864889440665798233365293235","77881542173507112263307380064211342026","249362072212518939250757881175323567662","72539237986682506029996587414484920798","300147712310460682737472915973676679737","177191404462661613789424113224262021214","74726855156126484846445209308089816609","308888422505619744642941575443296841535","224927459676769899826007061560303247602"],"threshold":0.9}},{"source":"https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28","target":{"file":"src/client/ns_turn_ioaddr.c","function":"addr_less_eq"},"deprecated":false,"digest":{"function_hash":"264811000418967689962522911415437547137","length":747},"id":"CVE-2026-73213-843dc5da","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28","target":{"file":"tests/test_ioaddr.c","function":"main"},"deprecated":false,"digest":{"function_hash":"166422964746423214207658160887834305393","length":1186},"id":"CVE-2026-73213-d1f6c9c8","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73213.json","vanir_signatures_modified":"2026-09-11T08:36:46Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}