Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
TurnServer.ReceiveUdpAsync places its generic catch (Exception) OUTSIDE the while receive loop, and Start() launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in 0x80–0xFF causes STUNHeader.ParseSTUNHeader to throw ApplicationException, which unwinds past the loop and terminates it. The TURN UDP relay is then dead for ALL clients until the process is restarted. Root Cause src/SIPSorcery/net/TURN/TurnServer.cs: - ReceiveUdpAsync (:555-577): the inner try (:562-567) wraps only udpSocket.ReceiveAsync(); HandleUdpDatagram(result.Buffer, result.RemoteEndPoint) (:569) is inside the while body but OUTSIDE that inner try. The generic catch (Exception ex) (:573) is lexically OUTSIDE the while. - Start() does = ReceiveUdpAsync(); (:381) — fire-and-forget, no restart. - HandleUdpDatagram (:579) calls STUNMessage.ParseSTUNMessage(data, data.Length) (:600) for any non-ChannelData datagram;…
Recommended action: Upgrade to 10.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields (each up to 65535) directly from an attacker-controlled SCTP SACK chunk and loops that many times reading 4 bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A single crafted SACK chunk from a negotiated WebRTC peer forces reads past the end of the 262144-byte receive buffer, raising IndexOutOfRangeException, which is not caught by the recoverable handler and terminates the dedicated SCTP receive thread — permanently killing the SCTP association and all data channels. Root Cause src/SIPSorcery/net/SCTP/Chunks/SctpSackChunk.cs: - ushort numGapAckBlocks = NetConvert.ParseUInt16(buffer, startPosn + 8); (:141) - ushort numDuplicateTSNs = NetConvert.ParseUInt16(buffer, startPosn + 10); (:142) - gap-ack loop (:146) and duplicate-TSN loop (:154) index the buffer via NetConvert.ParseUInt16/32 (buffer[posn], no bounds check — sys/Net/NetConvert.cs:30,41).…
Recommended action: Upgrade to 10.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet (and STUN attribute) bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception into a channel Close rather than dropping the packet. One small, unauthenticated packet therefore ends the media session. This is reachable during ICE connectivity checks — before the DTLS handshake and before any STUN MESSAGE-INTEGRITY verification. Because the RTP/ICE port is shared/advertised in the ICE candidates, a peer or on-path attacker can reach it (exposure is lower for a blind off-path attacker that must first learn the ephemeral port). Impact is availability only — no loss of confidentiality or integrity. Affected versions NuGet package SIPSorcery <= 10.0.8. Patches Fixed in 10.0.9. Root cause Two issues combine: 1. Unchecked indexing of untrusted bytes. -…
Recommended action: Upgrade to 10.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.