Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. SIPSorcery
  4. ›
  5. GHSA-pfvm-w89x-94jw

GHSA-pfvm-w89x-94jw: SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

August 12, 2026

TurnServer.ReceiveUdpAsync places its generic catch (Exception) OUTSIDE the while receive loop, and Start() launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in 0x80–0xFF causes STUNHeader.ParseSTUNHeader to throw ApplicationException, which unwinds past the loop and terminates it. The TURN UDP relay is then dead for ALL clients until the process is restarted.

References

  • github.com/advisories/GHSA-pfvm-w89x-94jw
  • github.com/sipsorcery-org/sipsorcery/commit/ccb0b5a845efa2fb131fd00de4f5321bae627f29
  • github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-pfvm-w89x-94jw

Code Behaviors & Features

Detect and mitigate GHSA-pfvm-w89x-94jw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 10.0.5 before 10.0.14

Fixed versions

  • 10.0.14

Solution

Upgrade to version 10.0.14 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-248: Uncaught Exception
  • CWE-755: Improper Handling of Exceptional Conditions

Source file

nuget/SIPSorcery/GHSA-pfvm-w89x-94jw.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Thu, 13 Aug 2026 12:21:53 +0000.