Bug 2514252 (CVE-2026-73213) - CVE-2026-73213 coturn: Coturn: Server-Side Request Forgery via incorrect IPv6 comparison
Summary: CVE-2026-73213 coturn: Coturn: Server-Side Request Forgery via incorrect IPv6...
Keywords:
Status: NEW
Alias: CVE-2026-73213
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-11 18:01 UTC by OSIDB Bzimport
Modified: 2026-08-14 17:54 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-11 18:01:57 UTC 
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
Note You need to log in before you can comment on or make changes to this bug.