In the turn server coturn version 4.15.0, an authenticated user can repeatedly resume an allocation while the mobility feature is enabled. Each new resume disarms the allocation timeout and replaces the pending resume link, causing earlier uncompleted sessions to be lost from the cleanup path. Because the server ignores quota increment failures, the attacker can chain many such resumes, keeping a large number of server‑side sessions alive and draining process memory until a denial‑of‑service condition occurs. The flaw is a classic uncontrolled resource consumption weakness (CWE‑400).

The vulnerability affects coturn servers using the coturn product in versions prior to 4.16.0, with the minimum affected release being 4.15.0. It is known to impact all builds that enable the --mobility option. The issue has been fixed in coturn 4.16.0 and later.

The CVSS score of 6.5 indicates a moderate severity. The exploit requires an attacker to authenticate with a valid TURN user and to have the --mobility flag enabled on the server. Since authentication is needed, the likelihood of exploitation is limited to threat actors with access to valid credentials, but within that scope the attacker can consume large amounts of memory to disrupt service. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting low to moderate exploitation probability.