CVE-2026-73215 is a resource exhaustion vulnerability in Coturn's even-port allocation logic. When a client requests an even port with the R=1 parameter (odd-port reservation enabled), the server marks the sibling odd port as TPS_TAKEN_ODD, expecting RTCP traffic to fire and release that reservation. However, when R=0 (no odd-port reservation), that same marking occurs but no RTCP cleanup path exists — the port becomes permanently reserved until process restart. A single authenticated client can rapidly exhaust the port pool by repeatedly triggering this condition, causing 508 errors for all subsequent users.
The root cause isn't a missing check — it's an implicit contract between code paths that was never made explicit. The TPS_TAKEN_ODD mechanism was designed with RTCP cleanup as a silent precondition. The developer likely tested the R=1 path thoroughly (dual-socket coordination attracts scrutiny) while treating R=0 as the simple default path that "just needs to not break." This is a cognitive shortcut: complexity gets audited, simplicity gets assumed safe.
The vulnerability has an unusually long exploitation-to-observable-failure latency. You won't see 508 errors until the pool is already dead — by then, multiple attackers have likely already degraded capacity. Small deployments may be practically unaffected, but operators who skip the 4.17.0 upgrade because they've never observed exhaustion will remain exposed when scale grows. Even after patching, poisoned slots don't recover without process restart.
Key checks: Verify your Coturn version is 4.17.0 or later. Review your port pool configuration — smaller pools limit blast radius but don't eliminate the vulnerability. Monitor for 508 errors as an indicator of active exploitation. For embedded Coturn instances bundled into VPN products or appliances, expect 6-18 months remediation lag; treat those deployments as at-risk until the vendor pushes the update.
This fits a recurring pattern across protocol implementations where resource state machines assume cooperative client behavior. Any code path that marks a resource with an implicit cleanup dependency should declare that dependency explicitly — static analysis should flag cases where the cleanup event is conditionally available. The Coturn patch fixes this instance; without that enforcement, the next implementation will discover the same flaw independently.