CVE-2025-69217
- Source
- https://cve.org/CVERecord?id=CVE-2025-69217
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69217.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-69217
- Aliases
-
- GHSA-fvj6-9jhg-9j84
- Downstream
- Related
- Published
- 2025-12-30T00:41:18.792Z
- Modified
- 2026-07-15T19:00:08.911500Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
- Summary
- Coturn has unsafe nonce and relay port randomization due to weak random number generation.
- Details
-
coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-338" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69217.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69217.json
- https://github.com/coturn/coturn/security/advisories/GHSA-fvj6-9jhg-9j84
- https://nvd.nist.gov/vuln/detail/CVE-2025-69217
- https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9
- https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6
Affected packages
Git / github.com/coturn/coturn
Affected versions
4.*
4.6.3
4.7.0
docker/4.*
docker/4.6.2-r10
docker/4.6.2-r11
docker/4.6.2-r12
docker/4.6.2-r13
docker/4.6.2-r5
docker/4.6.2-r6
docker/4.6.2-r7
docker/4.6.2-r8
docker/4.6.2-r9
docker/4.6.3-r0
docker/4.6.3-r1
docker/4.6.3-r2
docker/4.6.3-r3
docker/4.7.0-r0
docker/4.7.0-r1
docker/4.7.0-r2
docker/4.7.0-r3
docker/4.7.0-r4
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69217.json"
vanir_signatures
[
{
"id": "CVE-2025-69217-1ad86c88",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"214236864238421823216790558814134561554",
"264890891891111266571089548601223478199",
"199527371270515577088468841474059709594",
"161194442728405794821832730890518499427",
"198762068965018823340076781393291601247",
"140837786261135989635642550601956741366",
"266646832607508268168030238976907701192",
"335070634811984056690631349569039814567",
"112215632770556398464989866642416612363",
"165598847072016363891520623323127901348",
"243914836878772284138159850106365794417",
"186613297262190308780942409519886599705",
"12423327960293764799449137419174743012",
"178302868464115368092269987036778460385",
"96936868366239172309845437694791461039",
"61714001344089061007110565040073533511",
"117749886236043010120197614800271781100",
"274456183258337921434478293181954210929",
"49209915327517324569221864259464594675",
"283575614138618150230228967707523751080",
"127172747652013293555098633952267093929",
"271569293320604779523097552469903565698",
"10715553677988732202591218426144996119",
"304455570996468248220197235243039136783",
"218089162476102151400014372789197242087",
"188503631133314530129098698730644987400",
"320843918588421013482276962998786252043",
"318464094871736604107924012995144434607",
"237325317598853323416056635204301676420",
"285642072799969721448969051561008433808",
"281591614092659303144682685525723039889",
"160900624407656897849122940140580875526",
"61913728138536684639279022150823307668",
"93222706701349874464054978683490648635",
"150319400197289290710518507645717982782",
"104954073243940413045483544168609890911",
"187850735537865542618992143120564776072",
"32165233471757263596799243118448773449",
"136606312377997706335433036200572190805",
"83825980305256256038620638230347684050",
"325364444760788593803245694759228933141",
"163039251307651060939270604818686092054",
"170142607783081406637762651636456541153",
"94956055023642592375934624578268794928",
"74501203430138001154402527885540803409",
"329068116738451084180919699922566770236",
"36632316397085281090882154856296948688",
"75247916472872972160003044920057641107",
"317379600523097242391215064758360133745",
"162450909410235140461370829391296906484",
"34862470772454944617008078994353512480",
"130629843662606684086753114213586494457",
"147210392072650657294110643408634450729",
"67426819015359260072335190888631844369",
"235339157830609262176017652000519703080",
"29202373781606005075139352425424338060",
"304163102959980857221090277438823829227",
"73791375072297705099902798334358906308",
"51094444841048572162050059353768191883",
"12590577867107396590795621758550149127",
"253367252119085011829659781386394242908",
"132059707363073714877130340419428601561",
"34244346218071613976084094535664867610",
"336480544963546668196630651875058692137",
"110226709684649027665689560276888441755",
"185652680208466464050227744913603435344",
"157842884031510527666253042451850448957",
"61602515160381649851233389848704603472",
"168495761881689847230534071773060031276",
"62873099295767745517531159996235425385",
"149497104586255452994829749510840669606",
"123019516059660589693634992781144208106",
"72616596243566678670618342583974311289",
"295815372290758742558647026389493864280",
"235339157830609262176017652000519703080",
"29202373781606005075139352425424338060",
"304163102959980857221090277438823829227",
"73791375072297705099902798334358906308",
"51094444841048572162050059353768191883",
"12590577867107396590795621758550149127",
"253367252119085011829659781386394242908",
"132059707363073714877130340419428601561",
"34244346218071613976084094535664867610",
"336480544963546668196630651875058692137",
"110226709684649027665689560276888441755",
"185652680208466464050227744913603435344",
"61913728138536684639279022150823307668",
"93222706701349874464054978683490648635",
"150319400197289290710518507645717982782",
"104954073243940413045483544168609890911",
"187850735537865542618992143120564776072",
"32165233471757263596799243118448773449",
"136606312377997706335433036200572190805",
"83825980305256256038620638230347684050",
"325364444760788593803245694759228933141",
"163039251307651060939270604818686092054",
"170142607783081406637762651636456541153",
"94956055023642592375934624578268794928",
"74501203430138001154402527885540803409",
"329068116738451084180919699922566770236",
"36632316397085281090882154856296948688",
"113546736436641227434987795560535383364",
"338786263878906872754394763966600987962",
"236472667460818367697119109500720509972",
"34862470772454944617008078994353512480",
"130629843662606684086753114213586494457",
"147210392072650657294110643408634450729",
"67426819015359260072335190888631844369",
"235339157830609262176017652000519703080",
"29202373781606005075139352425424338060",
"304163102959980857221090277438823829227",
"73791375072297705099902798334358906308",
"51094444841048572162050059353768191883",
"12590577867107396590795621758550149127",
"253367252119085011829659781386394242908",
"132059707363073714877130340419428601561",
"34244346218071613976084094535664867610",
"336480544963546668196630651875058692137",
"182672373771754752449167887774673108065",
"308295497447488995174607561898142624905",
"34862470772454944617008078994353512480",
"130629843662606684086753114213586494457",
"147210392072650657294110643408634450729",
"104954073243940413045483544168609890911",
"187850735537865542618992143120564776072",
"32165233471757263596799243118448773449",
"136606312377997706335433036200572190805",
"2096973521835313884741252683623383624",
"257176773719050368066405443555205684634",
"337208594527695907194414935729808940618",
"5164474353101714447807606823751923888",
"49988104995708463756170803262148234044",
"194953555015737874738091318503697021106"
]
},
"target": {
"file": "src/apps/uclient/startuclient.c"
}
},
{
"id": "CVE-2025-69217-1cfc2b53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"331076185605938912203941836647321560019",
"265080854591668768878144568866581495940",
"262107510140970849533260143906078632664",
"340004708906780818840059119459949423842",
"151619534228870180686331111571236768922",
"204982900339873889522673049099918924500",
"2446808952775264930115090999119293896",
"255005706429715947078903464383532108399",
"36526407363682339994654221457253682205",
"215583182780092878482828922335328405056",
"116629061603896683035910946312046618850",
"88147698394263996997247124424157375286",
"237402347767775118459543897300281225014",
"44833677817979908469713508000903807662",
"173743884202434410092836290150418462213",
"305472168300448019167574559014610887948",
"247735702445488657808167671217734989336"
]
},
"target": {
"file": "src/server/ns_turn_server.c"
}
},
{
"id": "CVE-2025-69217-28e6b0cf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"164842828617088335868835279577915982116",
"183734301795430550389764243734343802032",
"328066729819783170854549823331781069986",
"113688307329753373725431667819579191784"
]
},
"target": {
"file": "src/client/ns_turn_msg.h"
}
},
{
"id": "CVE-2025-69217-372faac3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"51872804669314883032323118346509444024",
"132565151369929415552891279967041257988",
"164800015545428289036690824662930170236",
"37672411267367407096784170218731018129",
"66599320385918175923319181578258455908",
"57151856455074692480569204156169918889",
"255228997936868652534342984832249450133",
"337966247626833669683145792098378725746",
"181035504897326175813391125811469581695"
]
},
"target": {
"file": "src/apps/relay/turn_ports.c"
}
},
{
"id": "CVE-2025-69217-40d16d33",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"224626758254482990074685541147089587412",
"44405413953673108560496445888361115539",
"186392150999779695699577394794929950252",
"204618652767758781868561031125446001758",
"230768590644715209586649819220121364866",
"18883103982325892672685498729306756231",
"293383650943207518536299840581471669320",
"108515804088832063763671529112199980638"
]
},
"target": {
"file": "src/apps/relay/ns_ioalib_engine_impl.c"
}
},
{
"id": "CVE-2025-69217-7ec19555",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"212645240247905226576872119551399071859",
"298441132879059891753662578965973643514",
"199018494742257920427355251983491917721",
"73851096730192168509669636245095014476",
"329811812267307307194607441887142052062",
"179036647026404482386040224455073927880",
"113159245981358625111216543327290325613",
"90395279724177445489275131195814937255",
"177886721451562982233768499419841522235",
"146145431145258792286156209329561480347",
"121338942143910213745898687160934076453",
"9298974424544795122060730607327856270",
"274240851345282644824645086825373907798",
"220230258270472284498716221867007360213",
"312316614090908735728021994117928866435",
"1960774594917178292990518286490789444",
"205900732104743664988695863540982106747",
"307970513459675074148963791326534208573",
"170768117811144456504729767659655107353",
"54576869870853436301960172927051480611",
"119424231374328143288983368693046653386",
"86317044189531913625688224223588348846",
"42601619821692187679172546142378855349",
"313656804969796578881526785786324196832",
"263580740383065380247991418719617624784",
"179092100797808894519334563927995125848",
"280747588622656342146946927768824329038",
"172929596953189565753362889527804234537",
"158150258831978549060032318654288524620",
"247234599635499713167240466629819578426",
"255555502790603282391366436723504339302",
"297557971451002083274007618611852145127"
]
},
"target": {
"file": "src/apps/uclient/uclient.c"
}
},
{
"id": "CVE-2025-69217-abad3b33",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"315666085638214463586032089169833461128",
"12375284576361825748737262807567839772",
"211988205183708511096592680574396196928",
"108506971190631940488265042949666152651"
]
},
"target": {
"file": "src/server/ns_turn_allocation.c"
}
},
{
"id": "CVE-2025-69217-aca2fa22",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"124562052418420888273531982775292552718",
"295400061807953491963515747255077448092",
"315526809118164184311428419309590872811"
]
},
"target": {
"file": "src/apps/common/apputils.c"
}
},
{
"id": "CVE-2025-69217-cd26beb1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"171168467351387330034862871571840790855",
"234293457968104866971047287507401899792",
"83309533431716281004534515185526810120",
"338937642917069689562483624553428822244"
]
},
"target": {
"file": "src/apps/common/apputils.h"
}
},
{
"id": "CVE-2025-69217-ea55fe2d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"336081140188136859565830823105347541871",
"306081338385208892449308502081286907798",
"79347713568250576621131741683341929890",
"40442301216843665869506273905242065809",
"254620906810336504689604429224446783688",
"68269438216846796205634393727853113847",
"165784601807992691691066019188262819321",
"289853299660589367914647309890780530303",
"196360899207579120872126949430182346016",
"139528864009996402087312097028221071403",
"332809219518469564621985914804222800144",
"321873281657054203134782490752857048310",
"301428455994323779934666875087306203816",
"334926946518697225392136245709138138787",
"296598193358587958462784296136237251210",
"317780756060313052059029753211645415451"
]
},
"target": {
"file": "src/client/ns_turn_msg.c"
}
}
]
vanir_signatures_modified
"2026-07-15T19:00:08Z"