{"id":"CVE-2026-73216","title":"Coturn is a free open source implementation of TURN and STUN Server","summary":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage clos…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73216","references":[{"url":"https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/releases/tag/4.17.0","label":"security-advisories@github.com"},{"url":"https://github.com/coturn/coturn/security/advisories/GHSA-f6hc-79w3-p8pq","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.0057,"epssPercentile":0.44797,"ingestedAt":"2026-09-09T21:22:45.529Z","slug":"CVE-2026-73216","body":"## Overview\n\nCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}