DTLS listeners are now opt-in (#2026). The server no longer starts DTLS
listeners unless --dtls is given. A deployment that relied on DTLS being up by
default will stop serving DTLS clients after the upgrade, without an error. The
deprecated --no-dtls / --no-dtls=false spellings are still accepted and now
warn.

Stateless nonce is on by default (#2036). Challenge nonces are authenticated
timestamp cookies rather than a random value stored per session, so
unauthenticated UDP requests are answered from the listener without allocating a
session. Two consequences:

The challenge NONCE is now 24 characters instead of 16. RFC 8489 requires
clients to treat it as an opaque string of up to 128 characters, so compliant
clients are unaffected. --stateless-nonce=false restores the previous
behaviour.
The signing key is generated per process, so a restart costs each client one
438 re-authentication round-trip, as does a retry that lands on a different
instance behind a load balancer. Set --stateless-nonce-secret to the same
value across a fleet to avoid both.

The default log line changed (#2031, #2033). Timestamps are ISO-8601 with
millisecond precision, the thread id is gone, the field delimiter is a single
space instead of :, and each record now occupies exactly one line. Log
shippers and any downstream parsing will need updating; the default line is now:

2026-08-02T17:32:31.297-0700 INFO Listener address to use: 127.0.0.1

--new-log-timestamp=false restores the legacy seconds-since-start counter.

Security fixes

Three fixes in this release came through the private advisory process. Advisories
are still in preparation; this section will be updated with their identifiers
once they are published.

Allocation quotas could be bypassed under --mobility. An authenticated
client that repeatedly created a mobility allocation and disconnected had its
quota released while the allocation, its relay socket and its ticket stayed
alive, letting one user hold allocations well past --user-quota /
--total-quota until the relay port range was exhausted. The charge is now
held until final teardown. Regression coverage:
examples/run_tests_mobility_quota.sh.
DTLS allocated per-peer state before the cookie was verified. A
ClientHello from an unverified (and possibly spoofed) source caused a full
SSL, socket and session allocation before the source had proved return
routability. The cookie exchange is now performed statelessly via
DTLSv1_listen(), so an unanswered ClientHello leaves no state behind. This
completes the hardening begun in 4.16.0 (#2010, #2012, #2013).
EVEN-PORT with the R bit clear leaked relay ports. The odd sibling port
was reserved even when the client had not asked for it and was never released,
so a server would eventually refuse new allocations that requested
EVEN-PORT.

Upgrading is recommended for anyone running --mobility, DTLS, or accepting
EVEN-PORT allocations.

What's Changed

free the secrets list on the get_user_key error paths by @alhudz in #2019
Binding stateless fastpath by @eakraly in #2024
Worktree stateless nonce mi fastpath by @eakraly in #2025
Start the DTLS listeners only when --dtls is given by @eakraly in #2026
Do not ask the kernel for an outgoing IP TTL of zero by @eakraly in #2027
Drop --simple-log where it is a no-op alongside --log-file=stdout by @eakraly in #2028
Remove syslog from the Docker Compose turnserver.conf by @eakraly in #2029
Fix localtime() data race in the logger by @eakraly in #2030
Log format: ISO-8601 timestamp by default, no thread id, space delimiter by @eakraly in #2031
Keep the legacy random nonce at 16 chars by @eakraly in #2032
Emit exactly one log line per record by @eakraly in #2033
Enable stateless nonce by default by @eakraly in #2036

Full Changelog: https://github.com/coturn/coturn/compare/4.16.0...4.17.0

`v4.16.0`

Compare Source

What's Changed

Restore support for hiredis < 1.1.0 (for AlmaLinux/RHEL/Rocky Linux 9) by @robert-scheck in #2001
Add --stateless-nonce: bound memory under valid-structure STUN floods (#1999) by @eakraly in #2002
docs: cite RFC 7350 for DTLS support in README by @eakraly in #2004
DTLS listener: correct the handshake buffer bound and remove the non-functional client-cert path by @eakraly in #2003
Fix NULL deref: --prometheus-address/-path/-port take a required value by @eakraly in #2005
Return 508, not 400/440, when a well-formed Allocate cannot be satisfied by @eakraly in #2007
Narrow ChannelBind to the RFC 8656 channel range 0x4000-0x4FFF by @eakraly in #2006
Split --stun-backward-compatibility: move RFC 3489 handling to its own deprecated flag by @eakraly in #2008
docs: record the RFC 3489 deprecation roadmap; fix stale option text by @eakraly in #2009
DTLS: drop non-handshake records from unknown sources by @eakraly in #2010
DTLS: cap concurrent half-open handshakes (pre-cookie state-exhaustion) by @eakraly in #2012
docs: state OpenSSL 3.0+ as the supported target; drop stale guidance by @eakraly in #2011
DTLS: release idle handshake buffers on half-open sockets by @eakraly in #2013
docs: state the comment style expected in CLAUDE.md by @eakraly in #2014
Declare ERROR-CODE / ADDRESS-ERROR-CODE reason phrases without padding by @eakraly in #2015
Send: make a duplicate XOR-PEER-ADDRESS first-wins instead of last-wins by @eakraly in #2016
multiplex-peer: bound the shared per-thread peer demux table by @eakraly in #2017
tests: broaden TURN server core coverage to Send and CreatePermission by @eakraly in #2018

Full Changelog: https://github.com/coturn/coturn/compare/4.15.0...4.16.0

`v4.15.0`

Compare Source

Coturn 4.15.0

Security

Ignore STUN attributes after MESSAGE-INTEGRITY (GHSA-5538-7cxj-5jcc). Per RFC 8489 §9 / RFC 5389 §15.4, attributes following MESSAGE-INTEGRITY (other than FINGERPRINT) must be ignored, but coturn processed the full attribute list. This also fixes an interop bug where an RFC 8489 client sending MESSAGE-INTEGRITY-SHA256 after MESSAGE-INTEGRITY was wrongly answered with error 420.
Bind mobility session-resume to the original allocation owner (#1969) — a MOBILITY-TICKET resume is now only accepted from the user that created the allocation.
Reject ACME requests via signed 400 response (#1965) instead of silently dropping them.
Reset the reused UDP receive-buffer offset in the DTLS listener (#1986).
Zeroed channel-data padding in stun_init_channel_message_str so uninitialized stack bytes never reach the wire (#1984).
Fixed a uint16_t truncation overflow when computing STUN message length (#1964).
Fixed an off-by-one write past the realm buffer in redis_list_admin_users (#1978).
Fixed a size_t underflow in the telnet (CLI) _process data emit (#1980) and bounded MSSP subnegotiation parsing to the buffer end (#1972).
NULL-terminated the HTTP request buffer before it is logged verbatim (#1967); switched apputils.c to bounded snprintf (#1966).

New features

RFC 8016 graceful dual-5-tuple mobility handoff (#1975). A MOBILITY-TICKET resume no longer hard-switches the allocation at REFRESH time. The server now does a make-before-break transition: peer→client traffic stays on the old 5-tuple until the client's first packet arrives on the new one, and only then is the old socket discarded.
--drain-min-allocations (#1997) — a shutdown threshold for drain mode: the server exits once the live allocation count falls to the configured value instead of waiting for zero.
--log-min-level (log_min_level in the config file) (#1222) — a real minimum-log-level filter, since -v/--verbose had little effect on turnserver logging.
Alternate-server TCP/UDP distinction (#1605) — alternate servers are now tracked per transport, so TCP and UDP clients can be redirected to different alternate servers.
Fail-fast allocation wrappers (#1981) — all heap allocation in coturn-owned code goes through turn_malloc/turn_calloc/turn_realloc/turn_strdup, which log the call site and abort on OOM rather than risking NULL-dereference or silent degradation in a long-running server.

Reliability and correctness fixes

Fixed the remaining misaligned wire-buffer accesses and added alignment-safe turn_read_u16/u32/u64 / turn_write_* helpers (#1995, #1994) — misaligned reads of STUN attribute values were undefined behavior and a SIGBUS on strict-alignment targets.
Fixed uint32_t counter wraparound in the relay port allocator (#1992).
Worker threads are now joined on shutdown, fixing an exit-time OpenSSL race (#1991); OpenSSL atexit cleanup is disabled in turnserver (#1990).
Released the alternate-server list mutex when del_alt_server removes the last entry, fixing a deadlock (#1988, tests in #1989).
setgroups is no longer called unconditionally in mainrelay, fixing startup under environments where it's not permitted (#1508).
Freed EVP_CIPHER_CTX on error paths in the OAuth GCM encode/decode (#1962) and avoided leaks on realloc failure in TCP relay allocation (#1977).
Cast to unsigned char before isspace() in config-file parsing (#1968).
Log an explicit error when a configured tls-listening-port cannot start (#1974).
Autotools build now detects hiredis_ssl, enabling Redis TLS in the ./configure build (#1963).

Metrics

Every STUN Binding response is now counted in the Prometheus metrics (#1996).

Client utilities

turnutils_uclient now sends the SNI host name on TLS connections (#1973)
heap-allocates its STUN message buffers instead of using large stack buffers (#1976).

Contributors

@alhuda, @Cybermilitia, @tyranron, @networkException, @OrbisAI, @PaulWay, @eakraly

`v4.14.0`

Compare Source

New

No more dependency on https://github.com/digitalocean/prometheus-client-c for prometheus metrics! Prometheus library has been rewritten from scratch for the use of coturn. Functionality still depends on libmicrohttpd. Prometheus support is now compiled in if libmicrohttpd is available. Still needs to be enabled to function.
HTTPS support for prometheus client (optional)
TLS support for redis - now compatible with managed redis (optional)
Rate limiting "401 Unauthorized" responses - reduces reflection attacks off the coturn server. This is an experimental feature - not fully tested on production scale deployment and massive DDoS attacks. New prometheus counters should help shed some light on real life behavior and performance. The feature is off by default.

What's Changed

validate hmackey length in sqlite_get_user_key before hex decode by @alhudz in #1948
Add out-of-tree patch to restore deprecated OpenSSL 1.1.1 support by @eakraly in #1952
Add optional TLS transport for Redis connections by @eakraly in #1951
Fix relay threads override by @eakraly in #1953
Flush prometheus hot-path counters once per second to kill lock contention by @eakraly in #1954
fix signed-char index out-of-bounds read in base64_decode by @alhudz in #1950
Build Prometheus exporter from vendored local sources by @eakraly in #1955
Prom https by @eakraly in #1956
Fix realm quota data race and warnings by @eakraly in #1958
Add per-source rate-limiting of UDP 401 Unauthorized responses by @eakraly in #1957

Full Changelog: https://github.com/coturn/coturn/compare/4.13.1...4.14.0

`v4.13.1`

Compare Source

What's in this release

Security fixes

What's Changed

null-terminate server_name in stun_is_challenge_response_str by @alhudz in #1944
Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks by @eakraly in #1945
Auto-deny coturn's own database backend endpoints as relay peers by @eakraly in #1946
Deny link-local / ULA / site-local relay peers by default by @eakraly in #1947

New Contributors

@alhudz made their first contribution in #1944

Full Changelog: https://github.com/coturn/coturn/compare/4.13.0...4.13.1

`v4.13.0`

Compare Source

What's in this release

More performance improvements for --udp-recvmmsg and --multiplex-peer. If your system does not rely on TURN unique ports give multiplexing a try - it has capacity to dramatically increase performance.
Security fixes

What's Changed

Wrap atomic everywhere by @eakraly in #1922
Fix sendmmsg stride bug in multiplex-peer UDP batch flush by @eakraly in #1925
Reap TURN permissions/channels via a per-thread sweep instead of per-object timers by @eakraly in #1926
Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO batching by @eakraly in #1927
Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics by @eakraly in #1928
Restrict recvmmsg fast path to shared fan-in sockets (make --udp-recvmmsg useful standalone) by @eakraly in #1929
Enable --udp-recvmmsg by default on Linux by @eakraly in #1930
Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time compare, OAuth bounds checks, permission cap by @eakraly in #1932
Adapt .gitignore to allow files already in repo (#1935) by @tbart in #1936
Add continuous latency mode to stunclient by @eakraly in #1937
Fix test_redis_format link failure by @eakraly in #1939
Fix configure MANPREFIX typo by @misi in #1940
Fix missing sqlite3 dependendcy by @misi in #1941
Fix UDP receive buffer ownership by @eakraly in #1938

New Contributors

@tbart made their first contribution in #1936

Full Changelog: https://github.com/coturn/coturn/compare/4.12.0...4.13.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/coturn/coturn](https://github.com/coturn/coturn) | minor | `4.12.0` → `4.17.2` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/11) for more information. --- ### Release Notes <details> <summary>coturn/coturn (ghcr.io/coturn/coturn)</summary> ### [`v4.17.2`](https://github.com/coturn/coturn/releases/tag/4.17.2) [Compare Source](https://github.com/coturn/coturn/compare/4.17.1...4.17.2) #### What's Changed - Fix outgoing UDP TTL pinned to 1 on client-facing sockets in [#2045](https://github.com/coturn/coturn/pull/2045) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.17.1...4.17.2> ### [`v4.17.1`](https://github.com/coturn/coturn/releases/tag/4.17.1) [Compare Source](https://github.com/coturn/coturn/compare/4.17.0...4.17.1) #### What's Changed - Gate merges on the more tests suites by [@eakraly](https://github.com/eakraly) in [#2039](https://github.com/coturn/coturn/pull/2039) - build: Drop ginstall detection in configure by [@eakraly](https://github.com/eakraly) in [#2038](https://github.com/coturn/coturn/pull/2038) - Flash before socket close by [@eakraly](https://github.com/eakraly) in [#2041](https://github.com/coturn/coturn/pull/2041) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.17.0...4.17.1> ### [`v4.17.0`](https://github.com/coturn/coturn/releases/tag/4.17.0) [Compare Source](https://github.com/coturn/coturn/compare/4.16.0...4.17.0) #### Upgrade notes Three defaults changed in this release. Read these before upgrading. **DTLS listeners are now opt-in** ([#2026](https://github.com/coturn/coturn/issues/2026)). The server no longer starts DTLS listeners unless `--dtls` is given. A deployment that relied on DTLS being up by default will stop serving DTLS clients after the upgrade, without an error. The deprecated `--no-dtls` / `--no-dtls=false` spellings are still accepted and now warn. **Stateless nonce is on by default** ([#2036](https://github.com/coturn/coturn/issues/2036)). Challenge nonces are authenticated timestamp cookies rather than a random value stored per session, so unauthenticated UDP requests are answered from the listener without allocating a session. Two consequences: - The challenge `NONCE` is now 24 characters instead of 16. RFC 8489 requires clients to treat it as an opaque string of up to 128 characters, so compliant clients are unaffected. `--stateless-nonce=false` restores the previous behaviour. - The signing key is generated per process, so a restart costs each client one `438` re-authentication round-trip, as does a retry that lands on a different instance behind a load balancer. Set `--stateless-nonce-secret` to the same value across a fleet to avoid both. **The default log line changed** ([#2031](https://github.com/coturn/coturn/issues/2031), [#2033](https://github.com/coturn/coturn/issues/2033)). Timestamps are ISO-8601 with millisecond precision, the thread id is gone, the field delimiter is a single space instead of `:`, and each record now occupies exactly one line. Log shippers and any downstream parsing will need updating; the default line is now: ``` 2026-08-02T17:32:31.297-0700 INFO Listener address to use: 127.0.0.1 ``` `--new-log-timestamp=false` restores the legacy seconds-since-start counter. #### Security fixes Three fixes in this release came through the private advisory process. Advisories are still in preparation; this section will be updated with their identifiers once they are published. - **Allocation quotas could be bypassed under `--mobility`.** An authenticated client that repeatedly created a mobility allocation and disconnected had its quota released while the allocation, its relay socket and its ticket stayed alive, letting one user hold allocations well past `--user-quota` / `--total-quota` until the relay port range was exhausted. The charge is now held until final teardown. Regression coverage: `examples/run_tests_mobility_quota.sh`. - **DTLS allocated per-peer state before the cookie was verified.** A ClientHello from an unverified (and possibly spoofed) source caused a full SSL, socket and session allocation before the source had proved return routability. The cookie exchange is now performed statelessly via `DTLSv1_listen()`, so an unanswered ClientHello leaves no state behind. This completes the hardening begun in 4.16.0 ([#2010](https://github.com/coturn/coturn/issues/2010), [#2012](https://github.com/coturn/coturn/issues/2012), [#2013](https://github.com/coturn/coturn/issues/2013)). - **`EVEN-PORT` with the R bit clear leaked relay ports.** The odd sibling port was reserved even when the client had not asked for it and was never released, so a server would eventually refuse new allocations that requested `EVEN-PORT`. Upgrading is recommended for anyone running `--mobility`, DTLS, or accepting `EVEN-PORT` allocations. #### What's Changed - free the secrets list on the get\_user\_key error paths by [@alhudz](https://github.com/alhudz) in [#2019](https://github.com/coturn/coturn/pull/2019) - Binding stateless fastpath by [@eakraly](https://github.com/eakraly) in [#2024](https://github.com/coturn/coturn/pull/2024) - Worktree stateless nonce mi fastpath by [@eakraly](https://github.com/eakraly) in [#2025](https://github.com/coturn/coturn/pull/2025) - Start the DTLS listeners only when --dtls is given by [@eakraly](https://github.com/eakraly) in [#2026](https://github.com/coturn/coturn/pull/2026) - Do not ask the kernel for an outgoing IP TTL of zero by [@eakraly](https://github.com/eakraly) in [#2027](https://github.com/coturn/coturn/pull/2027) - Drop --simple-log where it is a no-op alongside --log-file=stdout by [@eakraly](https://github.com/eakraly) in [#2028](https://github.com/coturn/coturn/pull/2028) - Remove syslog from the Docker Compose turnserver.conf by [@eakraly](https://github.com/eakraly) in [#2029](https://github.com/coturn/coturn/pull/2029) - Fix localtime() data race in the logger by [@eakraly](https://github.com/eakraly) in [#2030](https://github.com/coturn/coturn/pull/2030) - Log format: ISO-8601 timestamp by default, no thread id, space delimiter by [@eakraly](https://github.com/eakraly) in [#2031](https://github.com/coturn/coturn/pull/2031) - Keep the legacy random nonce at 16 chars by [@eakraly](https://github.com/eakraly) in [#2032](https://github.com/coturn/coturn/pull/2032) - Emit exactly one log line per record by [@eakraly](https://github.com/eakraly) in [#2033](https://github.com/coturn/coturn/pull/2033) - Enable stateless nonce by default by [@eakraly](https://github.com/eakraly) in [#2036](https://github.com/coturn/coturn/pull/2036) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.16.0...4.17.0> ### [`v4.16.0`](https://github.com/coturn/coturn/releases/tag/4.16.0) [Compare Source](https://github.com/coturn/coturn/compare/4.15.0...4.16.0) #### What's Changed - Restore support for hiredis < 1.1.0 (for AlmaLinux/RHEL/Rocky Linux 9) by [@robert-scheck](https://github.com/robert-scheck) in [#2001](https://github.com/coturn/coturn/pull/2001) - Add --stateless-nonce: bound memory under valid-structure STUN floods ([#1999](https://github.com/coturn/coturn/issues/1999)) by [@eakraly](https://github.com/eakraly) in [#2002](https://github.com/coturn/coturn/pull/2002) - docs: cite RFC 7350 for DTLS support in README by [@eakraly](https://github.com/eakraly) in [#2004](https://github.com/coturn/coturn/pull/2004) - DTLS listener: correct the handshake buffer bound and remove the non-functional client-cert path by [@eakraly](https://github.com/eakraly) in [#2003](https://github.com/coturn/coturn/pull/2003) - Fix NULL deref: --prometheus-address/-path/-port take a required value by [@eakraly](https://github.com/eakraly) in [#2005](https://github.com/coturn/coturn/pull/2005) - Return 508, not 400/440, when a well-formed Allocate cannot be satisfied by [@eakraly](https://github.com/eakraly) in [#2007](https://github.com/coturn/coturn/pull/2007) - Narrow ChannelBind to the RFC 8656 channel range 0x4000-0x4FFF by [@eakraly](https://github.com/eakraly) in [#2006](https://github.com/coturn/coturn/pull/2006) - Split --stun-backward-compatibility: move RFC 3489 handling to its own deprecated flag by [@eakraly](https://github.com/eakraly) in [#2008](https://github.com/coturn/coturn/pull/2008) - docs: record the RFC 3489 deprecation roadmap; fix stale option text by [@eakraly](https://github.com/eakraly) in [#2009](https://github.com/coturn/coturn/pull/2009) - DTLS: drop non-handshake records from unknown sources by [@eakraly](https://github.com/eakraly) in [#2010](https://github.com/coturn/coturn/pull/2010) - DTLS: cap concurrent half-open handshakes (pre-cookie state-exhaustion) by [@eakraly](https://github.com/eakraly) in [#2012](https://github.com/coturn/coturn/pull/2012) - docs: state OpenSSL 3.0+ as the supported target; drop stale guidance by [@eakraly](https://github.com/eakraly) in [#2011](https://github.com/coturn/coturn/pull/2011) - DTLS: release idle handshake buffers on half-open sockets by [@eakraly](https://github.com/eakraly) in [#2013](https://github.com/coturn/coturn/pull/2013) - docs: state the comment style expected in CLAUDE.md by [@eakraly](https://github.com/eakraly) in [#2014](https://github.com/coturn/coturn/pull/2014) - Declare ERROR-CODE / ADDRESS-ERROR-CODE reason phrases without padding by [@eakraly](https://github.com/eakraly) in [#2015](https://github.com/coturn/coturn/pull/2015) - Send: make a duplicate XOR-PEER-ADDRESS first-wins instead of last-wins by [@eakraly](https://github.com/eakraly) in [#2016](https://github.com/coturn/coturn/pull/2016) - multiplex-peer: bound the shared per-thread peer demux table by [@eakraly](https://github.com/eakraly) in [#2017](https://github.com/coturn/coturn/pull/2017) - tests: broaden TURN server core coverage to Send and CreatePermission by [@eakraly](https://github.com/eakraly) in [#2018](https://github.com/coturn/coturn/pull/2018) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.15.0...4.16.0> ### [`v4.15.0`](https://github.com/coturn/coturn/releases/tag/4.15.0) [Compare Source](https://github.com/coturn/coturn/compare/4.14.0...4.15.0) ### Coturn 4.15.0 #### Security - **Ignore STUN attributes after MESSAGE-INTEGRITY** (GHSA-5538-7cxj-5jcc). Per RFC 8489 §9 / RFC 5389 §15.4, attributes following MESSAGE-INTEGRITY (other than FINGERPRINT) must be ignored, but coturn processed the full attribute list. This also fixes an interop bug where an RFC 8489 client sending MESSAGE-INTEGRITY-SHA256 after MESSAGE-INTEGRITY was wrongly answered with error 420. - **Bind mobility session-resume to the original allocation owner** ([#1969](https://github.com/coturn/coturn/issues/1969)) — a MOBILITY-TICKET resume is now only accepted from the user that created the allocation. - **Reject ACME requests via signed 400 response** ([#1965](https://github.com/coturn/coturn/issues/1965)) instead of silently dropping them. - Reset the reused UDP receive-buffer offset in the DTLS listener ([#1986](https://github.com/coturn/coturn/issues/1986)). - Zeroed channel-data padding in `stun_init_channel_message_str` so uninitialized stack bytes never reach the wire ([#1984](https://github.com/coturn/coturn/issues/1984)). - Fixed a `uint16_t` truncation overflow when computing STUN message length ([#1964](https://github.com/coturn/coturn/issues/1964)). - Fixed an off-by-one write past the realm buffer in `redis_list_admin_users` ([#1978](https://github.com/coturn/coturn/issues/1978)). - Fixed a `size_t` underflow in the telnet (CLI) `_process` data emit ([#1980](https://github.com/coturn/coturn/issues/1980)) and bounded MSSP subnegotiation parsing to the buffer end ([#1972](https://github.com/coturn/coturn/issues/1972)). - NULL-terminated the HTTP request buffer before it is logged verbatim ([#1967](https://github.com/coturn/coturn/issues/1967)); switched `apputils.c` to bounded `snprintf` ([#1966](https://github.com/coturn/coturn/issues/1966)). #### New features - **RFC 8016 graceful dual-5-tuple mobility handoff** ([#1975](https://github.com/coturn/coturn/issues/1975)). A MOBILITY-TICKET resume no longer hard-switches the allocation at REFRESH time. The server now does a make-before-break transition: peer→client traffic stays on the old 5-tuple until the client's first packet arrives on the new one, and only then is the old socket discarded. - **`--drain-min-allocations`** ([#1997](https://github.com/coturn/coturn/issues/1997)) — a shutdown threshold for drain mode: the server exits once the live allocation count falls to the configured value instead of waiting for zero. - **`--log-min-level`** (`log_min_level` in the config file) ([#1222](https://github.com/coturn/coturn/issues/1222)) — a real minimum-log-level filter, since `-v`/`--verbose` had little effect on turnserver logging. - **Alternate-server TCP/UDP distinction** ([#1605](https://github.com/coturn/coturn/issues/1605)) — alternate servers are now tracked per transport, so TCP and UDP clients can be redirected to different alternate servers. - **Fail-fast allocation wrappers** ([#1981](https://github.com/coturn/coturn/issues/1981)) — all heap allocation in coturn-owned code goes through `turn_malloc`/`turn_calloc`/`turn_realloc`/`turn_strdup`, which log the call site and abort on OOM rather than risking NULL-dereference or silent degradation in a long-running server. #### Reliability and correctness fixes - Fixed the remaining misaligned wire-buffer accesses and added alignment-safe `turn_read_u16/u32/u64` / `turn_write_*` helpers ([#1995](https://github.com/coturn/coturn/issues/1995), [#1994](https://github.com/coturn/coturn/issues/1994)) — misaligned reads of STUN attribute values were undefined behavior and a SIGBUS on strict-alignment targets. - Fixed `uint32_t` counter wraparound in the relay port allocator ([#1992](https://github.com/coturn/coturn/issues/1992)). - Worker threads are now joined on shutdown, fixing an exit-time OpenSSL race ([#1991](https://github.com/coturn/coturn/issues/1991)); OpenSSL atexit cleanup is disabled in turnserver ([#1990](https://github.com/coturn/coturn/issues/1990)). - Released the alternate-server list mutex when `del_alt_server` removes the last entry, fixing a deadlock ([#1988](https://github.com/coturn/coturn/issues/1988), tests in [#1989](https://github.com/coturn/coturn/issues/1989)). - `setgroups` is no longer called unconditionally in mainrelay, fixing startup under environments where it's not permitted ([#1508](https://github.com/coturn/coturn/issues/1508)). - Freed `EVP_CIPHER_CTX` on error paths in the OAuth GCM encode/decode ([#1962](https://github.com/coturn/coturn/issues/1962)) and avoided leaks on realloc failure in TCP relay allocation ([#1977](https://github.com/coturn/coturn/issues/1977)). - Cast to `unsigned char` before `isspace()` in config-file parsing ([#1968](https://github.com/coturn/coturn/issues/1968)). - Log an explicit error when a configured `tls-listening-port` cannot start ([#1974](https://github.com/coturn/coturn/issues/1974)). - Autotools build now detects `hiredis_ssl`, enabling Redis TLS in the `./configure` build ([#1963](https://github.com/coturn/coturn/issues/1963)). #### Metrics - Every STUN Binding response is now counted in the Prometheus metrics ([#1996](https://github.com/coturn/coturn/issues/1996)). #### Client utilities - `turnutils_uclient` now sends the SNI host name on TLS connections ([#1973](https://github.com/coturn/coturn/issues/1973)) - heap-allocates its STUN message buffers instead of using large stack buffers ([#1976](https://github.com/coturn/coturn/issues/1976)). #### Contributors [@alhuda](https://github.com/alhuda), [@Cybermilitia](https://github.com/Cybermilitia), [@tyranron](https://github.com/tyranron), [@networkException](https://github.com/networkException), [@OrbisAI](https://github.com/OrbisAI), [@PaulWay](https://github.com/PaulWay), [@eakraly](https://github.com/eakraly) ### [`v4.14.0`](https://github.com/coturn/coturn/releases/tag/4.14.0) [Compare Source](https://github.com/coturn/coturn/compare/4.13.1...4.14.0) #### New - No more dependency on <https://github.com/digitalocean/prometheus-client-c> for prometheus metrics! Prometheus library has been rewritten from scratch for the use of coturn. Functionality still depends on libmicrohttpd. Prometheus support is now compiled in if libmicrohttpd is available. Still needs to be enabled to function. - HTTPS support for prometheus client (optional) - TLS support for redis - now compatible with managed redis (optional) - Rate limiting "401 Unauthorized" responses - reduces reflection attacks off the coturn server. This is an experimental feature - not fully tested on production scale deployment and massive DDoS attacks. New prometheus counters should help shed some light on real life behavior and performance. The feature is off by default. #### What's Changed - validate hmackey length in sqlite\_get\_user\_key before hex decode by [@alhudz](https://github.com/alhudz) in [#1948](https://github.com/coturn/coturn/pull/1948) - Add out-of-tree patch to restore deprecated OpenSSL 1.1.1 support by [@eakraly](https://github.com/eakraly) in [#1952](https://github.com/coturn/coturn/pull/1952) - Add optional TLS transport for Redis connections by [@eakraly](https://github.com/eakraly) in [#1951](https://github.com/coturn/coturn/pull/1951) - Fix relay threads override by [@eakraly](https://github.com/eakraly) in [#1953](https://github.com/coturn/coturn/pull/1953) - Flush prometheus hot-path counters once per second to kill lock contention by [@eakraly](https://github.com/eakraly) in [#1954](https://github.com/coturn/coturn/pull/1954) - fix signed-char index out-of-bounds read in base64\_decode by [@alhudz](https://github.com/alhudz) in [#1950](https://github.com/coturn/coturn/pull/1950) - Build Prometheus exporter from vendored local sources by [@eakraly](https://github.com/eakraly) in [#1955](https://github.com/coturn/coturn/pull/1955) - Prom https by [@eakraly](https://github.com/eakraly) in [#1956](https://github.com/coturn/coturn/pull/1956) - Fix realm quota data race and warnings by [@eakraly](https://github.com/eakraly) in [#1958](https://github.com/coturn/coturn/pull/1958) - Add per-source rate-limiting of UDP 401 Unauthorized responses by [@eakraly](https://github.com/eakraly) in [#1957](https://github.com/coturn/coturn/pull/1957) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.13.1...4.14.0> ### [`v4.13.1`](https://github.com/coturn/coturn/releases/tag/4.13.1) [Compare Source](https://github.com/coturn/coturn/compare/4.13.0...4.13.1) #### What's in this release Security fixes #### What's Changed - null-terminate server\_name in stun\_is\_challenge\_response\_str by [@alhudz](https://github.com/alhudz) in [#1944](https://github.com/coturn/coturn/pull/1944) - Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks by [@eakraly](https://github.com/eakraly) in [#1945](https://github.com/coturn/coturn/pull/1945) - Auto-deny coturn's own database backend endpoints as relay peers by [@eakraly](https://github.com/eakraly) in [#1946](https://github.com/coturn/coturn/pull/1946) - Deny link-local / ULA / site-local relay peers by default by [@eakraly](https://github.com/eakraly) in [#1947](https://github.com/coturn/coturn/pull/1947) #### New Contributors - [@alhudz](https://github.com/alhudz) made their first contribution in [#1944](https://github.com/coturn/coturn/pull/1944) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.13.0...4.13.1> ### [`v4.13.0`](https://github.com/coturn/coturn/releases/tag/4.13.0) [Compare Source](https://github.com/coturn/coturn/compare/4.12.0...4.13.0) #### What's in this release - More performance improvements for `--udp-recvmmsg` and `--multiplex-peer`. If your system does not rely on TURN unique ports give multiplexing a try - it has capacity to dramatically increase performance. - Security fixes #### What's Changed - Wrap atomic everywhere by [@eakraly](https://github.com/eakraly) in [#1922](https://github.com/coturn/coturn/pull/1922) - Fix sendmmsg stride bug in multiplex-peer UDP batch flush by [@eakraly](https://github.com/eakraly) in [#1925](https://github.com/coturn/coturn/pull/1925) - Reap TURN permissions/channels via a per-thread sweep instead of per-object timers by [@eakraly](https://github.com/eakraly) in [#1926](https://github.com/coturn/coturn/pull/1926) - Add --udp-sendmmsg-log to observe egress sendmmsg/UDP-GSO batching by [@eakraly](https://github.com/eakraly) in [#1927](https://github.com/coturn/coturn/pull/1927) - Expose recvmmsg/sendmmsg UDP batch sizes as Prometheus metrics by [@eakraly](https://github.com/eakraly) in [#1928](https://github.com/coturn/coturn/pull/1928) - Restrict recvmmsg fast path to shared fan-in sockets (make --udp-recvmmsg useful standalone) by [@eakraly](https://github.com/eakraly) in [#1929](https://github.com/coturn/coturn/pull/1929) - Enable --udp-recvmmsg by default on Linux by [@eakraly](https://github.com/eakraly) in [#1930](https://github.com/coturn/coturn/pull/1930) - Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time compare, OAuth bounds checks, permission cap by [@eakraly](https://github.com/eakraly) in [#1932](https://github.com/coturn/coturn/pull/1932) - Adapt .gitignore to allow files already in repo ([#1935](https://github.com/coturn/coturn/issues/1935)) by [@tbart](https://github.com/tbart) in [#1936](https://github.com/coturn/coturn/pull/1936) - Add continuous latency mode to stunclient by [@eakraly](https://github.com/eakraly) in [#1937](https://github.com/coturn/coturn/pull/1937) - Fix test\_redis\_format link failure by [@eakraly](https://github.com/eakraly) in [#1939](https://github.com/coturn/coturn/pull/1939) - Fix configure MANPREFIX typo by [@misi](https://github.com/misi) in [#1940](https://github.com/coturn/coturn/pull/1940) - Fix missing sqlite3 dependendcy by [@misi](https://github.com/misi) in [#1941](https://github.com/coturn/coturn/pull/1941) - Fix UDP receive buffer ownership by [@eakraly](https://github.com/eakraly) in [#1938](https://github.com/coturn/coturn/pull/1938) #### New Contributors - [@tbart](https://github.com/tbart) made their first contribution in [#1936](https://github.com/coturn/coturn/pull/1936) **Full Changelog**: <https://github.com/coturn/coturn/compare/4.12.0...4.13.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-06-15 12:34:05 +02:00

Update ghcr.io/coturn/coturn Docker tag to v4.13.1 a083319e0f

simon511000 was assigned by renovate-bot

2026-06-15 12:34:05 +02:00

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from a083319e0f to 119a9bc91e

2026-06-15 14:18:47 +02:00

Compare

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from 119a9bc91e to 2500a177b5

2026-06-22 14:01:59 +02:00

Compare

renovate-bot changed title from ~~Update ghcr.io/coturn/coturn Docker tag to v4.13.1~~ to Update ghcr.io/coturn/coturn Docker tag to v4.14.0

2026-06-22 14:02:01 +02:00

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from 2500a177b5 to cde9c6f6ca

2026-07-22 14:03:21 +02:00

Compare

renovate-bot changed title from ~~Update ghcr.io/coturn/coturn Docker tag to v4.14.0~~ to Update ghcr.io/coturn/coturn Docker tag to v4.15.0

2026-07-22 14:03:23 +02:00

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from cde9c6f6ca to 813fa17ea9

2026-07-30 14:04:22 +02:00

Compare

renovate-bot changed title from ~~Update ghcr.io/coturn/coturn Docker tag to v4.15.0~~ to Update ghcr.io/coturn/coturn Docker tag to v4.16.0

2026-07-30 14:04:24 +02:00

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from 813fa17ea9 to 7bd771d2f4

2026-08-05 14:01:24 +02:00

Compare

renovate-bot changed title from ~~Update ghcr.io/coturn/coturn Docker tag to v4.16.0~~ to Update ghcr.io/coturn/coturn Docker tag to v4.17.0

2026-08-05 14:01:25 +02:00

renovate-bot force-pushed renovate/ghcr.io-coturn-coturn-4.x from 7bd771d2f4 to d56f5ce0f6

2026-08-11 14:01:42 +02:00

Compare

renovate-bot changed title from ~~Update ghcr.io/coturn/coturn Docker tag to v4.17.0~~ to Update ghcr.io/coturn/coturn Docker tag to v4.17.2

2026-08-11 14:01:44 +02:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/ghcr.io-coturn-coturn-4.x:renovate/ghcr.io-coturn-coturn-4.x

git switch renovate/ghcr.io-coturn-coturn-4.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/ghcr.io-coturn-coturn-4.x

git switch renovate/ghcr.io-coturn-coturn-4.x

git rebase main

git switch main

git merge --ff-only renovate/ghcr.io-coturn-coturn-4.x

git switch renovate/ghcr.io-coturn-coturn-4.x

git rebase main

git switch main

git merge --no-ff renovate/ghcr.io-coturn-coturn-4.x

git switch main

git merge --squash renovate/ghcr.io-coturn-coturn-4.x

git switch main

git merge --ff-only renovate/ghcr.io-coturn-coturn-4.x

git switch main

git merge renovate/ghcr.io-coturn-coturn-4.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

simon511000/homelab!6

No description provided.

Rows
Columns