CVE-2026-68555

This CVE is not a single flaw but a structural collision between two independently reasonable design choices that become dangerous together. The mobility subsystem uses a single pending-resume pointer—a one-slot buffer, not a queue—designed for occasional session migration, not repeated calls. The authentication path receives inc_quota() failure status but proceeds anyway, treating quota enforcement as advisory rather than mandatory. When both --user-quota and --mobility are enabled, each fresh UDP tuple overwrites the previous pending session's back-pointer while the quota layer silently authorizes the allocation anyway. The result is unbounded memory consumption through orphaned sessions that accumulate faster than any cleanup can catch them. The CVSS 6.5 score flatters to deceive. What matters is not the technical classification but the failure mode: coturn does not crash on memory exhaustion, it becomes unresponsive while silently dropping all relayed traffic. Downstream services—WebRTC calls that depend on TURN for NAT punch-through, VPN clients using TURN as fallback relay—experience silent failure with no error codes. Standard monitoring for process death misses this entirely; the symptom looks like network degradation, not a coturn bug. Prioritize your response by inventorying TURN deployments with both --user-quota and --mobility enabled. Upgrade to 4.16.0 immediately regardless of what the specific fix entailed, because the window for exploitation is the time between allocation and cleanup— attacker-controlled. If you cannot patch, reduce the mobility timeout aggressively and consider disabling mobility in multi-tenant environments. Three unresolved questions should inform your longer-term assessment. First, did 4.16.0 refactor the pending-resume tracking into a queue, or did it patch only the memory leak with a timeout sweep? If the latter, the architectural tension remains and similar bypasses could emerge from different trigger paths. Second, is the inc_quota() failure being ignored a pattern elsewhere in the codebase—this points to a systemic audit gap rather than an isolated oversight. Third, how does mobility interact with other quota mechanisms (realm-quota, total-allocation limits)—are those similarly bypassed? The 'authenticated user' precondition is also worth scrutinizing. In many Coturn deployments, authentication relies on static credentials or short-lived HMAC tokens with minimal provisioning overhead. The barrier to exploitation is 'have a valid TURN account,' not 'compromise an identity.' A single compromised account in a multi-tenant deployment can exhaust shared relay capacity and degrade service for every other legitimate user on that instance—making this effectively a single-tenant-can-affect-all-tenants failure with implications for shared-hosting threat models.

Reviewed through automated stages and approved by a human before publication.