CVE-2026-73213
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
Risk Assessment
The vulnerability can allow bypassing network restrictions, enabling communication with disallowed IP addresses, potentially leading to security policy violations.
Recommendation
It is recommended to update Coturn to version 4.16.0 or later and review denied-peer-ip configuration to ensure ranges are correctly defined.
Original NVD description (English source)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.