6 matches found
CVE-2026-73215
A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port...
CVE-2026-73215
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73215
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73215 The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73215 The coturn server can end in a state where it does not accept more requests with "even-port" enabled.
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73215
CVE-2026-73215 affects Coturn (TURN/STUN server). Before 4.17.0, in turn_ports.c, turnports_allocate_even() marks an unused odd port as TPS_TAKEN_ODD for an EVEN-PORT Allocate with R=0, even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool...