CVE-2025-69217
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In coturn versions 4.6.2r5 through 4.7.0-r4, a bad random number generator for nonces and port randomization was introduced after refactoring. Random numbers are generated with libc's random() instead of OpenSSL's RAND_bytes, allowing an attacker to reconstruct the RNG state after about 50 sequential nonces and predict future nonces and ports.
Risk Assessment
An attacker can predict nonces and ports, enabling authentication while spoofing IPs and predicting relay port allocation, potentially leading to unauthorized access and service disruption.
Recommendation
Update coturn to a version containing the fix (commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9) or later to restore secure random number generation.
Other vulnerabilities in coturn
See all- CVE-2026-104074Medium
Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.
- CVE-2026-68555Medium
Coturn version 4.15.0 has a vulnerability that allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing a handoff when --mobility is enabled. This leads to unbounded server-side sessions and process memory exhaustion even with --user-quota=1 configured.
- CVE-2026-68554Low
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.
- CVE-2026-68553High
In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.
- CVE-2026-68552Medium
Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.
- CVE-2026-73216Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.
- CVE-2026-73215High
Coturn before version 4.17.0 has a vulnerability in turnports_allocate_even() that marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508.
- CVE-2026-73214High
Coturn before version 4.16.0 has a vulnerability in dtls_server_input_handler() and create_new_connected_udp_socket() that retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation. An unauthenticated remote sender can exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing.
- CVE-2026-73213Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
- CVE-2026-73212Medium
Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.
Original NVD description (English source)
coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS