CVE-2026-73215: 
MinimOS vulnerability analysis and mitigation

CVE-2026-73215 is a Denial of Service vulnerability in Coturn, a free open-source TURN and STUN server implementation. The flaw exists in the turnports_allocate_even() function in src/apps/relay/turn_ports.c, where EVEN-PORT Allocate requests with the reservation bit R=0 incorrectly mark the unused odd sibling port as TPS_TAKEN_ODD, permanently leaking it from the relay port pool. All Coturn versions prior to 4.17.0 are affected. The vulnerability was published on August 11, 2026, and carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-772 (Missing Release of Resource after Effective Lifetime). Per RFC 8656 Section 14.6, an EVEN-PORT request with R=0 requests only an even relay port and must not reserve the next-higher (odd) sibling port; however, the pre-fix turnports_allocate_even() unconditionally marked the sibling as TPS_TAKEN_ODD regardless of the R bit value. Because no RTCP socket is ever bound to the sibling when R=0, nothing ever releases it, causing each such allocation to permanently remove one port from the pool. An authenticated attacker can repeatedly issue EVEN-PORT(R=0) Allocate requests to drain the entire relay port range, after which all further allocations fail with STUN error 508. The fix, applied in commit 4adbd82, returns the even port immediately when R=0, leaving the sibling in the pool, while leaving the R=1 path (which binds and lifetime-tracks the reserved socket) unchanged (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated client to permanently exhaust the Coturn relay port pool, causing all subsequent TURN allocation requests — including those from legitimate users — to fail with STUN error 508. The impact is limited to availability; there is no confidentiality or integrity impact. A particularly deceptive aspect of this vulnerability is that the server may report no active TURN allocations while still rejecting new EVEN-PORT allocation requests, making diagnosis difficult (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat). Exploitation requires authentication to the TURN server, which limits the attack surface to users with valid credentials. The EPSS score is approximately 0.0033 (low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact.

1. Obtain TURN credentials: Acquire valid credentials for the target Coturn server (e.g., through legitimate account access, credential theft, or a misconfigured open relay).
2. Identify target: Confirm the Coturn server version is prior to 4.17.0 and that EVEN-PORT allocations are accepted.
3. Send repeated EVEN-PORT(R=0) Allocate requests: Using a TURN client or custom script, repeatedly send TURN Allocate requests with the EVEN-PORT attribute and the reservation bit R set to 0. Each request causes the server to allocate an even port and permanently mark its odd sibling as TPS_TAKEN_ODD.
4. Exhaust the port pool: Continue sending requests until the relay port range is fully depleted. The server will log INFO: create_relay_ioa_sockets: no available ports but may show no active allocations.
5. Deny service: Once the pool is exhausted, all subsequent TURN Allocate requests (from any user) fail with STUN error 508, effectively blocking all TURN relay functionality (GitHub Advisory, GitHub Commit).

• Logs: Repeated log entries of INFO: create_relay_ioa_sockets: no available ports in the Coturn log, especially when no active allocations are reported; high volume of STUN error 508 responses in server logs.
• Network: Unusually high rate of TURN Allocate requests with the EVEN-PORT attribute from a single authenticated client or IP address; absence of corresponding RTCP socket activity alongside EVEN-PORT allocations.
• Operational: TURN relay service rejecting all new allocation requests with error 508 while the server reports zero or few active allocations — a discrepancy indicating port pool exhaustion (GitHub Advisory).

Upgrade Coturn to version 4.17.0 or later, which contains the fix for this vulnerability (Coturn Release). As a temporary mitigation prior to upgrading, consider implementing rate limiting on TURN Allocate requests per authenticated user to slow port pool exhaustion, and monitor for unusual patterns of failed allocations (STUN error 508) that may indicate an active attack. Restricting TURN access to trusted, known clients can also reduce exposure.