CVE-2026-73213

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73213", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-11T14:41:20.121Z", "datePublished": "2026-08-11T17:33:12.757Z", "dateUpdated": "2026-08-13T14:52:10.582Z"}, "containers": {"cna": {"title": "Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"}, {"name": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.16.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.16.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": "< 4.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:33:12.757Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0."}], "source": {"advisory": "GHSA-4v97-rxjj-4f99", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T14:52:04.854291Z", "id": "CVE-2026-73213", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:52:10.582Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73213", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:52:04.854291Z"}}}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T14:51:48.592Z"}}], "cna": {"title": "Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)", "source": {"advisory": "GHSA-4v97-rxjj-4f99", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"status": "affected", "version": "< 4.16.0"}]}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99", "name": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28", "name": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coturn/coturn/releases/tag/4.16.0", "name": "https://github.com/coturn/coturn/releases/tag/4.16.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:33:12.757Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73213", "state": "PUBLISHED", "dateUpdated": "2026-08-13T14:52:10.582Z", "dateReserved": "2026-08-11T14:41:20.121Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-11T17:33:12.757Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coturn", "vendor": "coturn", "versions": [{"status": "affected", "version": "< 4.16.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0."}], "id": "CVE-2026-73213", "lastModified": "2026-09-09T20:55:04.493", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73213", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T14:52:04.854291Z", "version": "2.0.3"}}]}, "published": "2026-08-11T18:18:26.640", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/releases/tag/4.16.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "coturn: Coturn: Server-Side Request Forgery via incorrect IPv6 comparison", "id": "2514252", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514252"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-918", "details": ["Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.", "A flaw was found in Coturn. An authenticated TURN client can bypass configured IP address restrictions due to an incorrect component-wise IPv6 comparison in the `addr_less_eq()` function. This allows the client to relay traffic to an IPv6 peer that should be denied, leading to a Server-Side Request Forgery (SSRF) vulnerability."], "mitigation": {"lang": "en:us", "value": "Update Coturn to version 4.16.0 or later, which replaces the incorrect component-wise IPv6 comparison with a correct memcmp-based ordering."}, "name": "CVE-2026-73213", "public_date": "2026-08-11T17:33:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73213\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73213\nhttps://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28\nhttps://github.com/coturn/coturn/releases/tag/4.16.0\nhttps://github.com/coturn/coturn/security/advisories/GHSA-4v97-rxjj-4f99"], "statement": "Red Hat products do not ship Coturn. The community packages (Fedora, EPEL) ship Coturn 4.16.0 which includes the fix for this vulnerability.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.16.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coturn", "source": "cna", "vendor": "coturn"}, "product": "coturn", "vendor": "coturn"}], "created": "2026-08-12T14:45:02.981070+00:00", "updated": "2026-08-15T02:00:04.207158+00:00", "vendors": ["coturn", "coturn$PRODUCT$coturn"]}