CVE-2026-73213

CVE-2026-73213 in Coturn reveals a fundamental semantic error in IPv6 range handling that goes beyond a typical programming mistake. The vulnerability lives in `addr_less_eq()`, which performs component-wise comparison on IPv6 addresses—when it should be evaluating them against prefix boundaries. This isn't a simple off-by-one error; it reflects code that was mechanically ported from IPv4 logic without anyone engaging with how IPv6 semantics actually work. The trigger condition matters: the bypass only activates with non-prefix-aligned denied-peer-ip ranges. In practice, most administrators configure deny rules using prefix boundaries (the way routing actually works), so this vulnerability likely remained dormant in many deployments. However, the CVSS of 5.8 undersells the risk for sensitive deployments. TURN servers sit as internet-facing relays in front of WebRTC, VoIP, and enterprise collaboration stacks—an attacker exploiting this doesn't just reach an unauthorized host; they potentially reach internal IPv6 infrastructure that should never be exposed, bypassing perimeter controls through a relay that administrators trusted. The real concern is whether the 4.16.0 fix addresses the underlying semantic gap or just patches the specific call site. This vulnerability follows a well-documented pattern dating back to mid-2000s IPv6 implementations—RFC 5952 even standardized canonical IPv6 representation because implementations couldn't agree on basic comparison semantics. The same class of errors appeared in early BGP implementations, iptables IPv6 extensions, and Cisco/Juniper ACL translations. If the fix only patched `addr_less_eq()` without establishing a proper prefix-aware comparison primitive, the same absent-design pattern likely persists in other IPv6 code paths. Audit your Coturn configuration: verify that any deny/allow rules use strict prefix boundaries (e.g., 2001:db8::/32, not 2001:db8::1 to 2001:db8::ffff). Assume other IPv6 address handling in the codebase carries the same semantic risk until proven otherwise—this vulnerability is probably the first documented member of a family, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.