Allocation of Resources Without Limits or Throttling in coTURN - #VU140949
Published: August 5, 2026
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the multiplex-peer demux table when processing SEND indications, CreatePermission, or ChannelBind requests with attacker-chosen XOR-PEER-ADDRESS values in multiplex-peer mode. A remote user can send specially crafted requests with many distinct peer IP:port combinations to cause a denial of service.
The issue is exposed when the server is started with --multiplex-peer. A single permitted peer IP can be expanded across many ports, and the shared per-worker-thread table is fully scanned during permission expiry and session teardown, which increases CPU consumption for other sessions on the same worker.