Description

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T21:17:28.453Z",
  "pubdate": "2026-08-19T21:17:28.453Z",
  "executiveSummary": "An allocation resource exhaustion vulnerability exists in Coturn version 4.15.0 when the server is configured with the --mobility option enabled.\nThe vulnerability allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing the expected handoff sequence.\nThis flaw leads to memory leaks and unbounded server-side session retention, effectively causing a denial of service through process memory exhaustion.\nThe issue impacts Coturn installations utilizing the mobility feature and bypasses resource control limits such as --user-quota=1.\nExploitation requires valid TURN user authentication and the ability to initiate network traffic toward the affected TURN/STUN server using UDP.\nThe vulnerability is fully resolved in version 4.16.0 by addressing the underlying state management and quota enforcement issues.",
  "technicalDetails": "The vulnerability resides in the src/server/ns_turn_server.c source file of Coturn version 4.15.0, specifically within the mobile_begin_transition() and copy_auth_parameters() functions.\nWhen the server operates with the --mobility flag enabled, processing a request to resume an allocation from a fresh UDP 5-tuple triggers mobile_begin_transition().\nThe root cause stems from two distinct logic flaws: first, the function disarms each new session's allocation timeout and overwrites the single mobile_pending_resume link of the allocation without properly cleaning up or handing off the previous state.\nThis behavior orphans earlier pending sessions, rendering them unreachable by the standard resource cleanup path and creating a persistent memory leak.\nSecond, copy_auth_parameters() fails to handle or check the return value of inc_quota(), ignoring quota allocation failures entirely.\nConsequently, an authenticated attacker can continuously generate new connection attempts and state transitions, bypassing configured enforcement limits like --user-quota=1.\nThe attack flow proceeds as follows: an authenticated attacker establishes an initial TURN allocation, then repeatedly initiates mobile resumption requests using novel UDP 5-tuples without completing the handoff handshake.\nEach iteration orphans the previous pending session state in memory while incrementing internal tracking structures without triggering quota rejections due to the unchecked inc_quota() failure.\nAs the attack progresses, the server continuously allocates uncollectible memory blocks for the unreachable sessions.\nThis unbounded accumulation of server-side state eventually exhausts available process memory, leading to a crash or severe degradation of the TURN/STUN server functionality.\nThe attack requires authentication against the TURN server, network exposure of the TURN service via UDP, and an environment where the --mobility configuration directive is active."
}