CVE-2026-73213

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73213
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73213.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73213
Aliases
  • GHSA-4v97-rxjj-4f99
Downstream
Related
Published
2026-08-11T17:33:12Z
Modified
2026-09-11T08:36:46Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)
Details

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73213.json"
}
References

Affected packages

Git / github.com/coturn/coturn

Affected ranges

Type
GIT
Repo
https://github.com/coturn/coturn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6c13608c28a04af5d63abddd7565a0dcc4771c28
Fixed
ef409b4227ca16bdd23b3e3eba38530292c20773
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.16.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*
4.10.0
4.11.0
4.12.0
4.13.0
4.13.1
4.14.0
4.15.0
4.4.5.3
4.4.5.4
4.5.0.1
4.5.0.2
4.5.0.3
4.5.0.4
4.5.0.5
4.5.0.6
4.5.0.7
4.5.1.0
4.5.1.1
4.5.1.2
4.5.1.3
4.5.2
4.6.0
4.6.2
4.6.3
4.7.0
4.8.0
4.9.0
docker/4.*
docker/4.10.0-r0
docker/4.10.0-r1
docker/4.11.0-r0
docker/4.12.0-r0
docker/4.13.0-r0
docker/4.13.1-r0
docker/4.14.0-r0
docker/4.15.0-r0
docker/4.5.2-r0
docker/4.5.2-r10
docker/4.5.2-r11
docker/4.5.2-r12
docker/4.5.2-r13
docker/4.5.2-r14
docker/4.5.2-r6
docker/4.5.2-r7
docker/4.5.2-r8
docker/4.5.2-r9
docker/4.6.0-r0
docker/4.6.0-r1
docker/4.6.1-r0
docker/4.6.1-r1
docker/4.6.1-r2
docker/4.6.1-r3
docker/4.6.2-r0
docker/4.6.2-r1
docker/4.6.2-r10
docker/4.6.2-r11
docker/4.6.2-r12
docker/4.6.2-r13
docker/4.6.2-r2
docker/4.6.2-r3
docker/4.6.2-r4
docker/4.6.2-r5
docker/4.6.2-r6
docker/4.6.2-r7
docker/4.6.2-r8
docker/4.6.2-r9
docker/4.6.3-r0
docker/4.6.3-r1
docker/4.6.3-r2
docker/4.6.3-r3
docker/4.7.0-r0
docker/4.7.0-r1
docker/4.7.0-r2
docker/4.7.0-r3
docker/4.7.0-r4
docker/4.8.0-r0
docker/4.8.0-r1
docker/4.9.0-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73213.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "13003910456361546551274353198828230562",
                "170571220873926324122468222440216504090",
                "202584497022650473230188544344601680326",
                "107323105523610947151998933456962123676",
                "308052641228891138093877115311867280666",
                "330615255684824283155325802543463521461",
                "286917366050493399229549351945536360543"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-73213-28dc310e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28",
        "target": {
            "file": "tests/test_ioaddr.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120560996744269810542235267652752672867",
                "308464990571648349526301640883181461714",
                "46167370824864889440665798233365293235",
                "77881542173507112263307380064211342026",
                "249362072212518939250757881175323567662",
                "72539237986682506029996587414484920798",
                "300147712310460682737472915973676679737",
                "177191404462661613789424113224262021214",
                "74726855156126484846445209308089816609",
                "308888422505619744642941575443296841535",
                "224927459676769899826007061560303247602"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-73213-5588dc44",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28",
        "target": {
            "file": "src/client/ns_turn_ioaddr.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "264811000418967689962522911415437547137",
            "length": 747
        },
        "id": "CVE-2026-73213-843dc5da",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28",
        "target": {
            "file": "src/client/ns_turn_ioaddr.c",
            "function": "addr_less_eq"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "166422964746423214207658160887834305393",
            "length": 1186
        },
        "id": "CVE-2026-73213-d1f6c9c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28",
        "target": {
            "file": "tests/test_ioaddr.c",
            "function": "main"
        }
    }
]
vanir_signatures_modified 
"2026-09-11T08:36:46Z"