CVE-2026-73212

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73212
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73212.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73212
Aliases
  • GHSA-2x4g-wx24-48m4
Downstream
Published
2026-08-11T17:31:43.961Z
Modified
2026-08-13T08:06:41.869547Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
Details

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr() in src/server/nsturnserver.c uses ioaaddrinrange() in src/client/nsturn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73212.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/coturn/coturn

Affected ranges

Type
GIT
Repo
https://github.com/coturn/coturn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf4b4952de48510d38415b96300da5fc674bfdda
Fixed
d49ee56aa9fe748af064853d5e430eec1ccc3cbc
Fixed
f696c74fced6a5c05df555139e51cfce6b3e2802
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.13.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*
4.10.0
4.11.0
4.12.0
4.13.0
4.4.5.3
4.4.5.4
4.5.0.1
4.5.0.2
4.5.0.3
4.5.0.4
4.5.0.5
4.5.0.6
4.5.0.7
4.5.1.0
4.5.1.1
4.5.1.2
4.5.1.3
4.5.2
4.6.0
4.6.2
4.6.3
4.7.0
4.8.0
4.9.0
docker/4.*
docker/4.10.0-r0
docker/4.10.0-r1
docker/4.11.0-r0
docker/4.12.0-r0
docker/4.5.2-r0
docker/4.5.2-r10
docker/4.5.2-r11
docker/4.5.2-r12
docker/4.5.2-r13
docker/4.5.2-r14
docker/4.5.2-r6
docker/4.5.2-r7
docker/4.5.2-r8
docker/4.5.2-r9
docker/4.6.0-r0
docker/4.6.0-r1
docker/4.6.1-r0
docker/4.6.1-r1
docker/4.6.1-r2
docker/4.6.1-r3
docker/4.6.2-r0
docker/4.6.2-r1
docker/4.6.2-r10
docker/4.6.2-r11
docker/4.6.2-r12
docker/4.6.2-r13
docker/4.6.2-r2
docker/4.6.2-r3
docker/4.6.2-r4
docker/4.6.2-r5
docker/4.6.2-r6
docker/4.6.2-r7
docker/4.6.2-r8
docker/4.6.2-r9
docker/4.6.3-r0
docker/4.6.3-r1
docker/4.6.3-r2
docker/4.6.3-r3
docker/4.7.0-r0
docker/4.7.0-r1
docker/4.7.0-r2
docker/4.7.0-r3
docker/4.7.0-r4
docker/4.8.0-r0
docker/4.8.0-r1
docker/4.9.0-r0

Database specific

vanir_signatures_modified 
"2026-08-13T08:06:41Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-73212-08bd3f29",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "144044545338260599198113116632053069505",
                "7148339465883900300752751605354834566",
                "194217777750976600931697608059255056003",
                "106678661995320731839739969210669588442"
            ]
        },
        "source": "https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc",
        "target": {
            "file": "src/server/ns_turn_server.c"
        }
    },
    {
        "id": "CVE-2026-73212-0a07666f",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 710.0,
            "function_hash": "198467360605203208723281685747105879148"
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "function": "main",
            "file": "tests/test_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-2811a598",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "231845268547749734859923506570142811809",
                "93328447809025428638579479010601090610",
                "310983623423119537528838843870811311442",
                "8567001965666574673905331775927043985",
                "232895132753571416521742968925417046331",
                "242970148054073517503536024996794830206",
                "92932165966170216058717651854032456382",
                "100549025137796857742718556045935255631",
                "106146356491434805232521002955025492303",
                "35868905053095208166130349001413809353",
                "201430485139780064012631053888737544172",
                "29186316876286775703334839929301948538",
                "146365534533010756486321660037579158131",
                "261415759950214912580456461030324003968",
                "328229849245042859960723634910714417444",
                "47533685617045507019554978102902179825",
                "79031368299208363065900501424797693022",
                "32027773395356315815698922316369793558",
                "268677261783066883655271510289671886209",
                "23035565974460601582007217483560531767",
                "17695763211657480235128609770701565516",
                "65281553999759924704715056143105730158",
                "89965137571467684514311411315314847973",
                "107073750223578926905403376800219888733",
                "115583093538107113751843374359923672309",
                "145174782235946091340299764001516325413",
                "201323896808688106171494325566298221919",
                "10101747285742613244093701589247280562",
                "119364723841867062746303414758710267683",
                "198505625127046035110651891715055347472",
                "256322552975266024840508404376721889990",
                "266996849340453278956531182564775370378",
                "6807080301974336807740423311724447467",
                "94565756595371361879396329938927468913",
                "307418082343887439285027088670875692366",
                "256682302824954597806939344752801210214",
                "116428322841099359976108842002603783435",
                "148657917596857223561210742477537820564",
                "18241772197660393362744770360675203938",
                "202505009707059628979706328332002955608",
                "268038016772748850803691701167009146771",
                "119594422018000296140634679510125597043",
                "44594492717051067512330329410817014586",
                "5058953202058253860536145475666501182",
                "81931692230316830795078206657339622666",
                "177194212389401238167643088782693816980",
                "143161306463000959728003866272967310702",
                "68630939616778103177188740956152931463",
                "103209455738584986819839160808118498936",
                "99451377433655794018633471570645083470",
                "79320272210584344500052932796045833857",
                "109088451656471905639205527166513447584",
                "57826210874374045830754921082802307077",
                "96070293587630998257326716649739859398",
                "31076393714998640146350507487475402391",
                "79256649503694984882418547198140658640"
            ]
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "file": "src/client/ns_turn_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-2cd5e70b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 544.0,
            "function_hash": "106959670199216232202092369075248787839"
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "function": "ioa_addr_is_loopback",
            "file": "src/client/ns_turn_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-4060fcb8",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "169973713728298437936014722245402819990",
                "268385381143081086792170283978431198512",
                "310352832323857239197718622195920949974",
                "111692991681024890751417999694402280577",
                "196386566215050067300581479588547534883",
                "212793816677128781745505377528243233657"
            ]
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "file": "tests/test_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-42f365ae",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 448.0,
            "function_hash": "200592091559670493766309036252197552385"
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "function": "ioa_addr_is_multicast",
            "file": "src/client/ns_turn_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-525adcfe",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "55606295847433098034840009046217933004",
                "296849415753679227564017088546233471130",
                "235735912907085649180709437546252041531",
                "121420556583371237221318256895813248202",
                "157841318376202038880259683006455433743"
            ]
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "file": "src/client/ns_turn_ioaddr.h"
        }
    },
    {
        "id": "CVE-2026-73212-ab4d48c3",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 733.0,
            "function_hash": "45351566854461191350199241582286227894"
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "function": "ioa_addr_in_range",
            "file": "src/client/ns_turn_ioaddr.c"
        }
    },
    {
        "id": "CVE-2026-73212-b7cc474b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2191.0,
            "function_hash": "292503820364436671972078477740557628331"
        },
        "source": "https://github.com/coturn/coturn/commit/d49ee56aa9fe748af064853d5e430eec1ccc3cbc",
        "target": {
            "function": "good_peer_addr",
            "file": "src/server/ns_turn_server.c"
        }
    },
    {
        "id": "CVE-2026-73212-be5ceb3a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 571.0,
            "function_hash": "26544299712436691186354389100416881424"
        },
        "source": "https://github.com/coturn/coturn/commit/cf4b4952de48510d38415b96300da5fc674bfdda",
        "target": {
            "function": "ioa_addr_is_zero",
            "file": "src/client/ns_turn_ioaddr.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73212.json"