CVE-2026-73216

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73216", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-11T14:41:20.121Z", "datePublished": "2026-08-11T17:39:46.635Z", "dateUpdated": "2026-08-11T19:00:45.196Z"}, "containers": {"cna": {"title": "coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq"}, {"name": "https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.17.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": "< 4.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:39:46.635Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0."}], "source": {"advisory": "GHSA-f6hc-79w3-p8pq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T19:00:33.660151Z", "id": "CVE-2026-73216", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T19:00:45.196Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73216", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-11T14:41:20.121Z", "datePublished": "2026-08-11T17:39:46.635Z", "dateUpdated": "2026-08-11T19:00:45.196Z"}, "containers": {"cna": {"title": "coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq"}, {"name": "https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.17.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": "< 4.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T17:39:46.635Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0."}], "source": {"advisory": "GHSA-f6hc-79w3-p8pq", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73216", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T19:00:33.660151Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T18:59:59.625Z"}}]}}

{"affected": [{"affectedData": [{"product": "coturn", "vendor": "coturn", "versions": [{"status": "affected", "version": "< 4.17.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0."}], "id": "CVE-2026-73216", "lastModified": "2026-09-09T20:55:04.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73216", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T19:00:33.660151Z", "version": "2.0.3"}}]}, "published": "2026-08-11T18:18:27.040", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/releases/tag/4.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "coturn: coturn: Authenticated client can exhaust relay capacity via quota bypass", "id": "2514248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514248"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.", "A flaw was found in coturn. An authenticated client can exploit a vulnerability in the `shutdown_client_connection()` function, which prematurely releases bandwidth accounting during the first stage of closing a mobility-enabled allocation. This allows the client to bypass user and total quotas, leading to the exhaustion of relay ports and a Denial of Service (DoS) condition."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-73216", "public_date": "2026-08-11T17:39:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73216\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73216\nhttps://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b\nhttps://github.com/coturn/coturn/releases/tag/4.17.0\nhttps://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq"], "statement": "Red Hat has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.17.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coturn", "source": "cna", "vendor": "coturn"}, "product": "coturn", "vendor": "coturn"}], "created": "2026-08-12T13:15:04.606031+00:00", "updated": "2026-08-13T14:15:05.226380+00:00", "vendors": ["coturn", "coturn$PRODUCT$coturn"]}