Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T18:18:27.040Z",
  "pubdate": "2026-08-11T18:18:27.040Z",
  "executiveSummary": "A quota bypass and resource exhaustion vulnerability exists in Coturn prior to version 4.17.0 within the mobility-enabled allocation handling mechanism. The vulnerability is triggered by premature execution of accounting functions during the first-stage close of a client connection.\nThe flaw allows authenticated clients to bypass configured --user-quota and --total-quota limits, leading to potential exhaustion of available relay ports on the TURN/STUN server.\nThe affected product is Coturn, specifically versions prior to 4.17.0. The risk implications include denial of service through resource exhaustion and circumvention of administrative resource controls.\nTo exploit this vulnerability, an attacker requires authentication credentials to interact with the TURN server and must establish mobility-enabled allocations. No additional privileges beyond standard client authentication are mentioned as necessary.",
  "technicalDetails": "The root cause of the vulnerability resides in the function shutdown_client_connection() located within src/server/ns_turn_server.c in Coturn prior to version 4.17.0.\nDuring the first-stage close of a mobility-enabled allocation, the vulnerable function prematurely invokes dec_quota() and releases the associated bandwidth accounting.\nHowever, despite releasing the quota and bandwidth accounting allocations, the function preserves the underlying allocation, the relay socket, the active session, and the mobility ticket.\nThis asynchronous state tracking discrepancy allows an authenticated client to maintain active relay resources while simultaneously freeing up their allocated quota counters.\nBy repeatedly initiating and transitioning mobility-enabled allocations through this sequence, an authenticated client can bypass --user-quota and --total-quota enforcement mechanisms.\nThe step-by-step attack flow involves the client authenticating to the Coturn server, establishing a mobility-enabled allocation that consumes resource quotas, and triggering the vulnerable first-stage close via shutdown_client_connection().\nBecause the quota is decremented and released while the allocation and relay socket remain preserved, the client's current quota usage appears lower than actual consumption.\nThe attacker can then repeatedly open new allocations without hitting the enforcement thresholds, progressively exhausting the server's available relay ports and resulting in a denial of service condition.\nThe vulnerable component is the connection shutdown and quota accounting logic in src/server/ns_turn_server.c. The vulnerability affects all Coturn versions prior to 4.17.0.\nExploitation requires network exposure to the TURN/STUN server ports and valid client authentication credentials, but does not require elevated administrative privileges."
}