EUVD-2026-56823Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because exploitation requires a valid TURN credential; A:H because the relay port pool can be fully exhausted causing complete service denial; no confidentiality or integrity impact and scope is unchanged.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0.
AnalysisAI
Relay port pool exhaustion in Coturn prior to 4.17.0 permits authenticated TURN clients to permanently consume relay ports by issuing EVEN-PORT Allocate requests with the R (reservation) bit cleared to zero. The turnports_allocate_even() function in src/apps/relay/turn_ports.c unconditionally marked the odd sibling port as TPS_TAKEN_ODD regardless of R bit value; with R=0 no RTCP socket is ever bound to that port, so no release code path is ever triggered - each such allocation permanently removes one port from the relay pool until the pool is drained and subsequent allocations fail with STUN error 508. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid TURN session with at least low-privileged credentials (PR:L per the CVSS 4.0 vector) - unauthenticated attackers cannot reach the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N, VA:H) accurately captures the threat model: a low-privileged network attacker can cause high availability impact with low complexity and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated TURN client establishes a session using valid credentials obtained through normal registration or credential theft, then sends a stream of EVEN-PORT Allocate requests each with R=0. Each request causes the server to silently leak one odd-numbered relay port from the pool. … |
| Remediation | Upgrade Coturn to version 4.17.0 or later, which is the vendor-released patch confirmed by GitHub release tag https://github.com/coturn/coturn/releases/tag/4.17.0 and commit 4adbd82e78456e13109bf44deed4ec3aceb0bab2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Coturn deployments to identify instances running versions prior to 4.17.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today