Bug#1144385: coturn: CVE-2026-73213 CVE-2026-73214 CVE-2026-73215 CVE-2026-73216

Source: coturn
Version: 4.15.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for coturn.

CVE-2026-73213[0]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses
| a component-wise comparison for native IPv6 min-max intervals in
| ioa_addr_in_range(), allowing an authenticated TURN client to relay
| to an IPv6 peer that is numerically within a configured non-prefix-
| aligned denied-peer-ip range but is classified as outside it. This
| issue is fixed in version 4.16.0.


CVE-2026-73214[1]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.16.0, dtls_server_input_handler() and
| create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c
| retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte
| fragmented ClientHello declaring a 650,000-byte handshake before
| cookie validation, allowing an unauthenticated remote sender using
| fresh UDP tuples to exhaust memory without TURN credentials, a
| completed handshake, a valid cookie, or source spoofing. This issue
| is fixed in version 4.16.0.


CVE-2026-73215[2]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.17.0, turnports_allocate_even() in
| src/apps/relay/turn_ports.c marks the unused odd sibling port as
| TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit
| R=0 even though no RTCP socket will release it, allowing an
| authenticated client to permanently exhaust the relay port pool and
| cause subsequent allocations to fail with STUN error 508. This issue
| is fixed in version 4.17.0.


CVE-2026-73216[3]:
| Coturn is a free open source implementation of TURN and STUN Server.
| Prior to 4.17.0, shutdown_client_connection() in
| src/server/ns_turn_server.c prematurely calls dec_quota() and
| releases bandwidth accounting during the first-stage close of a
| mobility-enabled allocation while preserving the allocation, relay
| socket, session, and mobility ticket, allowing an authenticated
| client to bypass --user-quota and --total-quota and exhaust relay
| ports. This issue is fixed in version 4.17.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73213
    https://www.cve.org/CVERecord?id=CVE-2026-73213
[1] https://security-tracker.debian.org/tracker/CVE-2026-73214
    https://www.cve.org/CVERecord?id=CVE-2026-73214
[2] https://security-tracker.debian.org/tracker/CVE-2026-73215
    https://www.cve.org/CVERecord?id=CVE-2026-73215
[3] https://security-tracker.debian.org/tracker/CVE-2026-73216
    https://www.cve.org/CVERecord?id=CVE-2026-73216

Regards,
Salvatore