Coturn’s DTLS listener allocates a full TLS session object before verifying the DTLS cookie, allowing an unauthenticated remote sender to send a large, fragmented ClientHello that claims a 650,000‑byte handshake. This allocates 35‑byte fragment state regardless of source authenticity, exhausting server memory and resulting in a denial of service. The flaw exemplifies uncontrolled resource consumption (CWE‑400) and improper memory allocation (CWE‑770). The attacker does not need TURN credentials or a valid cookie, making the vulnerability broadly exploitable.

The coturn TURN/STUN server is affected, specifically all releases before version 4.16.0. Any deployment running an older coturn version remains vulnerable to this memory‑exhaustion attack.

The vulnerability carries a CVSS score of 8.2, indicating high severity, yet the EPSS score is below 1%, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. The attack vector is a crafted UDP stream containing fragmented DTLS handshakes, which can be initiated from any external IP. While the memory consumption is bounded by the server’s configuration, the impact on a busy TURN server can be significant, potentially denying service to legitimate clients.