CVE-2026-68555
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
CVE-2026-68555- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-63080
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
EUVD-2026-63080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
CVE-2026-68555- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
coturn: Chained mobility resumes allow authenticated remote memory exhaustion
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
CVE-2026-68555- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-68555
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
DEBIAN-CVE-2026-68555- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-68555
Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
- Record
UBUNTU-CVE-2026-68555- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11617-1 No score
coturn-4.17.2-1.1 on GA media
These are all security issues fixed in the coturn-4.17.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11617-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
coturnDebian:12 |
All versions, plus listed versions 4.12.0-14.14.0-14.15.0-14.18.0-14.6.1-14.6.1-2 |
None known |
coturnDebian:13 |
All versions, plus listed versions 4.12.0-14.14.0-14.15.0-14.18.0-14.6.1-2 |
None known |
coturnDebian:14 |
before 4.18.0-1, plus listed versions 4.12.0-14.14.0-14.15.0-14.6.1-2 |
4.18.0-1 |
coturnUbuntu:16.04:LTS |
All versions, plus listed versions 4.4.5.4-24.5.0.2-34.5.0.3-14.5.0.3-1build14.5.0.3-1ubuntu0.24.5.0.3-1ubuntu0.34.5.0.3-1ubuntu0.4 |
None known |
coturnUbuntu:18.04:LTS |
All versions, plus listed versions 4.5.0.6-1ubuntu24.5.0.7-1ubuntu14.5.0.7-1ubuntu24.5.0.7-1ubuntu2.18.04.14.5.0.7-1ubuntu2.18.04.24.5.0.7-1ubuntu2.18.04.3 |
None known |
coturnUbuntu:20.04:LTS |
All versions, plus listed versions 4.5.1.1-1.1build14.5.1.1-1.1build24.5.1.1-1.1ubuntu0.20.04.14.5.1.1-1.1ubuntu0.20.04.2 |
None known |
coturnUbuntu:22.04:LTS |
All versions, plus listed versions 4.5.2-34.5.2-3.1~ubuntu22.04.1 |
None known |
coturnUbuntu:24.04:LTS |
All versions, plus listed versions 4.6.1-1build14.6.1-1build24.6.1-1build34.6.1-1build4 |
None known |
coturnUbuntu:26.10 |
All versions, plus listed versions 4.6.1-2build24.12.0-14.14.0-14.15.0-14.18.0-1 |
None known |
coturnUbuntu:26.04:LTS |
All versions, plus listed versions 4.6.1-2build14.6.1-2build2 |
None known |
coturnopenSUSE:Tumbleweed From an advisory covering 17 CVEs |
before 4.17.2-1.1 | 4.17.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-68555 is a medium vulnerability (CVSS 6.5) in Coturn, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in coturn 4.18.0-1.
References
github.com/coturn/coturn/security/advisories/GHSA-hpq3-g7x4-h7xx
nvd.nist.gov/vuln/detail/CVE-2026-68555
security-tracker.debian.org/tracker/CVE-2026-68555
Show 19 moreShow less
ubuntu.com/security/CVE-2026-68555
cve.org/CVERecord?id=CVE-2026-68555
suse.com/security/cve/CVE-2026-40613