Coturn CVE-2026-73214

The attacker must have UDP connectivity to the Coturn DTLS listener port (commonly UDP 3478 or 5349). No TURN credentials, completed DTLS handshake, valid RFC 6347 cookie, or IP spoofing capability are required - the CVE description explicitly states all four preconditions are absent. The attacker must use fresh UDP source tuples (distinct IP/port pairs) per ClientHello, as indicated by the CVSS 4.0 AT:P metric; this prevents trivial single-socket flooding but is met by any attacker capable of rotating source ports or controlling multiple addresses. The vulnerability is present whenever the DTLS listener is active, which is the typical configuration for WebRTC relay deployments. Exploitation is bounded in version 4.16.0 by the 16-slots-per-relay-thread cap that rejects new handshakes before state allocation.

The CVSS 4.0 score of 8.2 with vector AV:N/AC:L/AT:P/PR:N/UI:N reflects a network-reachable, unauthenticated attack with no user interaction required, with AT:P (Attack Requirements: Present) indicating the attacker must supply fresh UDP source tuples per ClientHello to bypass per-source limiting - a low but nonzero bar. Impact is limited entirely to availability (VA:H), with no confidentiality or integrity effect on either the vulnerable or subsequent systems. No CISA KEV listing exists and no public exploit has been identified; EPSS data was not provided in the input and exploitation probability must therefore be inferred from structural simplicity alone. Despite the absence of known exploitation, the mechanics require no credentials, no handshake completion, no valid cookie, and no source spoofing capability, meaning that even a mid-sized municipal IT team in tczew operating a public TURN relay should treat this as an urgent patching priority rather than a deferred hygiene item. The AT:P metric appropriately tempers the rating versus a pure AC:L assessment, but the multi-source-tuple requirement is trivially satisfied by any attacker with port rotation capability or multiple source addresses.

An attacker with UDP connectivity to the Coturn DTLS listener sends a continuous stream of 35-byte fragmented DTLS ClientHello messages, each declaring a 650,000-byte total handshake length and each originating from a distinct UDP source tuple via port rotation. For each message, Coturn allocates a per-peer SSL context and OpenSSL fragment reassembly buffer based on the declared length before any cookie validation, accumulating hundreds of megabytes of heap memory until the process is terminated by the OS OOM killer or becomes unresponsive. No public proof-of-concept code has been identified, but the technique is straightforward to implement using standard DTLS libraries or raw UDP crafting tools given the detailed public description.