{"id":"CVE-2026-73216","summary":"coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.","aliases":["GHSA-f6hc-79w3-p8pq"],"modified":"2026-09-11T08:36:49.251891Z","published":"2026-08-11T17:39:46.635Z","related":["openSUSE-SU-2026:11617-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73216.json"},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.17.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73216.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73216"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"3c5b2615fd405c4e7c5bf3fbeef895c94a90671b"},{"fixed":"54ef76cebfff2bb99b35438858a4ef412d84128d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.17.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["docker/4.16.0-r0","4.16.0","docker/4.15.0-r0","4.15.0","docker/4.14.0-r0","4.14.0","docker/4.13.1-r0","docker/4.13.0-r0","4.13.1","4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73216.json","vanir_signatures_modified":"2026-09-11T08:36:49Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","target":{"file":"src/server/ns_turn_server.c"},"deprecated":false,"digest":{"line_hashes":["284418415630703822157742685254414656090","190700017774265426065976205211843004138","266060142464653003967778713026338741458","136317193361017594009921457187406750970","261296765725423502300012669734068194795","16120462576750529850924629992706215470","192267401964916622274583606052882688453","68853123703499268298739773981223468576","77513059515371313053459493818780182890","331988247826755800415931265550557551288","117903732253076877733284683542950669841","226880439994167860350954285082532706930","254886783138731667474817898704190346085","330929793519688951781723634477199355160","103747187563527729274629971388967781120","276125665066417263191465786370330905266","313536934423071173281384088054761415175","248062165778416687088633074745918380053","156629283307152927094490654223124534299","296075471390769160911372484036633924484","97747843621417287293576409725102744407","279055748930329485925321367146630133681","107682324461402890808359742766715966349","43723733549544826312030569472836815561","322988966816309807998208821437965033410","316856003018583194269220690472134424581","250243647826160792060274500724804881298","312151809379488115096504935649518899667","316765849375783270825675499904843095809"],"threshold":0.9},"id":"CVE-2026-73216-148ae1b1","signature_type":"Line"},{"digest":{"function_hash":"225249939718554927742643716162888639389","length":2943},"id":"CVE-2026-73216-2026fe1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","target":{"file":"src/server/ns_turn_server.c","function":"shutdown_client_connection"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","target":{"file":"src/server/ns_turn_server.c","function":"handle_turn_refresh"},"deprecated":false,"digest":{"function_hash":"202992070420880395941968952450384723150","length":7984},"id":"CVE-2026-73216-80fd1c35"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","target":{"file":"src/server/ns_turn_server.c","function":"copy_auth_parameters"},"deprecated":false,"digest":{"function_hash":"229324240201153198075030720133920193541","length":901},"id":"CVE-2026-73216-8b5337ff"},{"deprecated":false,"digest":{"function_hash":"339791811384726706664702143460364292826","length":819},"id":"CVE-2026-73216-bc9abb6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","target":{"file":"src/server/ns_turn_server.c","function":"mobile_complete_transition"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}