{"id":"CVE-2026-73215","summary":"The coturn server can end in a state where it does not accept more requests with \"even-port\" enabled.","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.","aliases":["GHSA-847g-qmc6-6m4r"],"modified":"2026-09-11T08:36:48.012839Z","published":"2026-08-11T17:38:07.500Z","related":["openSUSE-SU-2026:11617-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400","CWE-772"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73215.json"},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.17.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73215.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-847g-qmc6-6m4r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73215"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"4adbd82e78456e13109bf44deed4ec3aceb0bab2"},{"fixed":"54ef76cebfff2bb99b35438858a4ef412d84128d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.17.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["docker/4.16.0-r0","4.16.0","docker/4.15.0-r0","4.15.0","docker/4.14.0-r0","4.14.0","docker/4.13.1-r0","docker/4.13.0-r0","4.13.1","4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73215.json","vanir_signatures_modified":"2026-09-11T08:36:48Z","vanir_signatures":[{"id":"CVE-2026-73215-23e3b44a","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2","target":{"file":"tests/test_turn_ports.c"},"deprecated":false,"digest":{"line_hashes":["275519185228863536481613059275152337653","338201987055085180980795125900326370925","264171971958610222376948731547349555606","196182974858933460607867866324315728957","265743542106237093375371604670048438686","21986555742135978378813801908615341875"],"threshold":0.9}},{"digest":{"length":171,"function_hash":"235257818117326417716178025756663689156"},"id":"CVE-2026-73215-8bb02957","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2","target":{"file":"tests/test_turn_ports.c","function":"main"},"deprecated":false},{"digest":{"function_hash":"73343917500610226055852444411111714805","length":997},"id":"CVE-2026-73215-bd0252d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2","target":{"file":"src/apps/relay/turn_ports.c","function":"turnports_allocate_even"},"deprecated":false},{"digest":{"line_hashes":["49385822839285586044217839126780425369","244337112225425186742897508200483648931","307502784687446480240548599603914335537","62968090904766722360590298312465247515","196273206692274226237709316481806991442","210830622243326393241454842449235006300","268677242751981548699941387552059026867","118471108140969053381005942816989411272"],"threshold":0.9},"id":"CVE-2026-73215-c15c48f5","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/4adbd82e78456e13109bf44deed4ec3aceb0bab2","target":{"file":"src/apps/relay/turn_ports.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}