EUVD-2026-56825Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable attack requiring valid TURN credentials (PR:L) with high availability impact from relay port exhaustion; no confidentiality or integrity impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.
AnalysisAI
Quota accounting bypass in Coturn TURN/STUN server prior to 4.17.0 allows authenticated remote clients to exhaust relay ports by repeatedly creating and disconnecting mobility-enabled allocations. The shutdown_client_connection() function in src/server/ns_turn_server.c prematurely releases the user and total quota charge during the first-stage mobility close while the allocation, relay socket, session, and mobility ticket remain alive, making --user-quota and --total-quota enforcement ineffective. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two explicit conditions: the Coturn server must be started with the `--mobility` flag enabled (a non-default, operator-configured feature), and the attacker must possess valid TURN credentials accepted by the server's `--user` or credential store. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately captures the attack profile: network-accessible, low complexity, but gated behind authenticated TURN credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid TURN credentials connects to a Coturn server running with `--mobility` enabled, issues an Allocate request over TCP with the MOBILITY attribute set and REQUESTED-TRANSPORT UDP, then immediately closes the TCP connection. The server performs the first-stage mobility close, releases the quota counter, but retains the live relay port. … |
| Remediation | Upgrade Coturn to version 4.17.0, which addresses the premature `dec_quota()` call in `shutdown_client_connection()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today