{"id":"CVE-2026-73214","summary":"coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.","aliases":["GHSA-5x2p-4vqj-f6m4"],"modified":"2026-08-13T08:06:42.704052Z","published":"2026-08-11T17:34:51.860Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73214.json"},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.16.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73214.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-5x2p-4vqj-f6m4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73214"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09"},{"type":"FIX","url":"https://github.com/coturn/coturn/pull/2003"},{"type":"FIX","url":"https://github.com/coturn/coturn/pull/2012"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"37e13d1d60af8f1422c01b5e9f1c6bc355d03b85"},{"fixed":"beb4de9dcb6a475129595b943c9a34264420df09"},{"fixed":"ef409b4227ca16bdd23b3e3eba38530292c20773"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.16.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["docker/4.15.0-r0","4.15.0","docker/4.14.0-r0","4.14.0","docker/4.13.1-r0","docker/4.13.0-r0","4.13.1","4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73214.json","vanir_signatures_modified":"2026-08-13T08:06:42Z","vanir_signatures":[{"id":"CVE-2026-73214-1ce8662e","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"file":"src/apps/relay/dtls_listener.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["331125047025194496898670719913399952433","262025689590931796420563892487203026823","118836901332139367040572292672265743182","264256488083987401654660299636195322100","297610938155113066344099612495102727961","133680720446478708583906575708341482141","103303890157149446463782842512988857990","156563434030646471895038041984165543631","14996712563672684965155317262091507541","67885761115807310685523802111358147693","2325889453840926132107704936022844158","329864392967372361878352530492143453982","297125046751777802395496156581284167342","72998258909654493919052146087209902637","20726742010686759098361073202288857797","167522766632222348507235258248626134472","309702168707318548155301633120536058712"]}},{"source":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09","target":{"file":"src/apps/relay/dtls_listener.c"},"deprecated":false,"digest":{"line_hashes":["45624082420325121513158994345917832713","22390025512677162325994067817075209808","205880060642703663635191590604678925763","331125047025194496898670719913399952433","262025689590931796420563892487203026823","118836901332139367040572292672265743182","180225533252736142112173862999868627015","107964141158870512288468682804982225924","278569494583382631005958805783600374464","118121346737586585892008221761768938686","180225533252736142112173862999868627015","147313615246325607834772253593667116710","109213324689766794440555083449233713916","134796581350886152233599771244092622884","261063313302562031259767184982063380188","284277811031622922916059883895337584394","83591266304769136937367880537715308287","77199974043661505322042437081969689208","216754124723979364817550440713713683047","273077385699813306488505155213619660789","43675843843743512903179361968230726087","252050544225504490322576291772681145695","258448245958835092411928073404397728463","218666788344191851022261768783001877968","82906102318963486411726354897380902463","320681615745367916424943619828280608327","117195146685924214620987959275941678557","105615149291225030596984300062291876443","66100851026347100619748950552312835200","167761046305264935524206043275941503774","80787946293454936509836039629934749952"],"threshold":0.9},"id":"CVE-2026-73214-210ab92c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09","target":{"file":"src/apps/relay/dtls_listener.c","function":"create_new_connected_udp_socket"},"deprecated":false,"digest":{"function_hash":"85396565805237852578528774048754461808","length":3311},"id":"CVE-2026-73214-34e6482c","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-73214-52743f86","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09","target":{"file":"src/apps/relay/dtls_listener.c","function":"setup_dtls_callbacks"},"deprecated":false,"digest":{"function_hash":"318451794728998767702656662578183545061","length":269}},{"source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"file":"src/apps/relay/dtls_listener.c","function":"dtls_server_input_handler"},"deprecated":false,"digest":{"function_hash":"281634239020663642826576182303906038646","length":988},"id":"CVE-2026-73214-5a22bd42","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":107,"function_hash":"43777435097486430847919225279751077655"},"id":"CVE-2026-73214-5efc1f37","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09","target":{"function":"dtls_verify_callback","file":"src/apps/relay/dtls_listener.c"}},{"source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"file":"src/apps/relay/dtls_listener.c","function":"handle_udp_packet"},"deprecated":false,"digest":{"function_hash":"36667242587378167193335047883561494808","length":4936},"id":"CVE-2026-73214-87986d1c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"file":"src/apps/relay/ns_ioalib_engine_impl.c"},"deprecated":false,"digest":{"line_hashes":["175430312169035053420625277654443396355","200131296202601565334975312895570515179","264340444955255987188940742927501062263","210739844757364416409216682335847855872","333459291084373828620323408217581671750","326217542509312988839278347802351949427"],"threshold":0.9},"id":"CVE-2026-73214-972e1ac8","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["122778582319393966478294691778742855038","102090996703157507095203115039328467967","308531903996702316993153464240367142910","197563396732878351416551396169660715062","188371631244287094526715612249800405470","201218561899921023845777411566967994867","320667866326165816445051667443656579582"],"threshold":0.9},"id":"CVE-2026-73214-a06b58bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"file":"src/apps/relay/ns_ioalib_impl.h"}},{"digest":{"function_hash":"40870694980306472090594677111185601752","length":1397},"id":"CVE-2026-73214-bac1bea1","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85","target":{"function":"close_ioa_socket","file":"src/apps/relay/ns_ioalib_engine_impl.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"99130805163033611256447896656270977276","length":971},"id":"CVE-2026-73214-cffbae69","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09","target":{"file":"src/apps/relay/dtls_listener.c","function":"dtls_server_input_handler"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}