CyberRota Analysis
AI-GeneratedCoturn versions prior to 4.17.0 contain a vulnerability in the shutdown_client_connection() function that allows authenticated clients to bypass user and total quotas, potentially leading to exhaustion of relay ports. This can impact the availability of the TURN server, affecting services reliant on it for real-time communications. Organizations using Coturn for TURN/STUN services should prioritize updating to version 4.17.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.