coturn DTLS Cookie Bypass Resource Exhaustion DoS (CVE-2026-7214) Analysis and POC

coturn Vulnerability Summary Overview Vulnerability Name: coturn allocates full SSL/session per peer before verifying DTLS cookies, leading to source spoofing/zombie state exhaustion DoS CVE ID: CVE-2026-7214 CVSS Score: 8.2 / 10 (High) Vulnerability Type: Resource Exhaustion (Availability: High) Attack Vector: Network (Network) Attack Complexity: Low (Low) Required Privileges: None (None) User Interaction: None (None) Affected Scope Affected Versions: coturn <= 4.15.0 Fixed Version: coturn 4.16.0 Vulnerability Description: - coturn retains a stateful OpenSSL DTLS connection for the initial fragmented before verifying the DTLS cookie. - An unauthenticated fragment claiming 35 bytes can trigger a 650,000-byte handshake message, causing OpenSSL to allocate and zero-initialize the fragment reassembly bitmap. - Repeating this process quickly increases memory usage from new UDP source sockets. - No TURN credentials, handshake completion, valid cookie, source address spoofing, or response handling is required. A single host can create distinct tuples by varying the UDP source port. Technical Details Key Code: Cause of Memory Growth: - For incomplete fragments, OpenSSL's allocates a virtual fragment body and zero-initializes bytes of reassembly state. - The zeroed bitmap immediately contributes to RSS (Resident Set Size). - The original report attributed the observed memory growth to occurring after cookie verification. Independent tracing revealed that is only reached when the bitmap is complete, while the directly observable overhead comes from early fragment bitmaps plus retained Coturn/OpenSSL sessions. Valid cookies are unnecessary. Reproducing Impact Testing Method: - A single runner sends 500 initial 35-byte fragmented , claiming a message length of 650,000 bytes. Results: - Only 17,500 bytes of attacker payload on the vulnerable build generated approximately 78 MB of additional RSS. - Incomplete sessions are released after Coturn's default 60-second session timeout, but sustained arrival can exhaust memory. - RSS may remain elevated after object release because the allocator retains free pages. - A 128 MB limit OOM (Out of Memory) killed Coturn 4.15.0 after 697 accepted sessions from a single runner IP and unique source port. - In a clean run, two unprotected bursts of 20,000 packets crashed Coturn 4.15.0 within three seconds, with a peak RSS of 609,878,016 bytes. - Coturn 4.16.0 remained operational under the same 40,000 packet workload, with a peak RSS of 13,254,656 bytes and OOM counters reset to zero. Remediation Upgrade Version: Upgrade to Coturn 4.16.0 or later. Workarounds: - If upgrading is not immediately possible, disable unnecessary DTLS. - Rate limit global and per-source new DTLS handshakes. - Reduce and . - Enforce process/container memory limits and monitor for restarts as containment measures. Fix Content: - Coturn 4.16.0 added a process-level cap on half-open DTLS sessions to prevent unlimited session growth per peer, and reduced the accepted handshake message limit. Exploit Code (POC) Sending DTLS Handshake Record: Repeat Attack: Solutions and Recommendations Upgrade Version: Upgrade to Coturn 4.16.0 or later. Workarounds: - If upgrading is not immediately possible, disable unnecessary DTLS. - Rate limit global and per-source new DTLS handshakes. - Reduce and . - Enforce process/container memory limits and monitor for restarts as containment measures.

Goal Reached Thanks to every supporter — we hit 100%!

coturn DTLS Cookie Bypass Resource Exhaustion DoS (CVE-2026-7214) Analysis and POC

More from this source