CVE-2026-73214

Katalog CVE

CVSS 8.2 · High EPSS 0,58%

Kerentanan Uncontrolled Resource Consumption. Skor CVSS 4.0 8.2 (High) menurut github.com.

Deskripsi (NVD)

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtls_server_input_handler() and create_new_connected_udp_socket() in src/apps/relay/dtls_listener.c retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation, allowing an unauthenticated remote sender using fresh UDP tuples to exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing. This issue is fixed in version 4.16.0.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 4.0

8.2 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/coturn/coturn/commit/37e13d1d60af8f1422c01b5e9f1c6bc355d03b85
• https://github.com/coturn/coturn/commit/beb4de9dcb6a475129595b943c9a34264420df09
• https://github.com/coturn/coturn/pull/2003
• https://github.com/coturn/coturn/pull/2012
• https://github.com/coturn/coturn/releases/tag/4.16.0
• https://github.com/coturn/coturn/security/advisories/GHSA-5x2p-4vqj-f6m4