Description

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while UdpReceiver.EndReceiveFrom closes the channel when those operations raise a non-socket exception. A remote party can send a single short RTP packet or malformed zero-to-seven-byte STUN address attribute to the shared RTP/ICE socket, including during ICE connectivity checks before DTLS or STUN MESSAGE-INTEGRITY verification, and terminate the active RTP or WebRTC media session. The attacker must reach or learn the advertised ephemeral RTP/ICE port, but no authentication or user interaction is required, and the impact is limited to availability. This issue is fixed in version 10.0.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T20:16:47.010Z",
  "pubdate": "2026-09-14T20:16:47.010Z",
  "executiveSummary": "SIPSorcery versions prior to 10.0.9 are susceptible to a Denial of Service (DoS) vulnerability triggered by improper input validation during RTP and STUN packet parsing.\nThe vulnerability resides in the core library's handling of untrusted bytes within RTPChannel and various STUN attribute parsing functions.\nA remote, unauthenticated attacker can exploit this flaw by sending malformed, short-length packets to an active RTP/ICE port, causing the library to terminate the underlying transport channel.\nThis vulnerability is particularly dangerous as it can be leveraged during the ICE connectivity check phase, prior to the establishment of cryptographic verification mechanisms like DTLS or STUN MESSAGE-INTEGRITY.\nThe primary impact is service availability loss, as affected media sessions are abruptly closed upon the occurrence of non-socket exceptions triggered by these malformed packets.\nExploitation requires the attacker to identify the target's ephemeral RTP/ICE port but requires no authentication or user interaction, posing a significant risk to the stability of WebRTC and VoIP communications powered by SIPSorcery.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient bounds checking mechanism within the packet processing pipeline of the SIPSorcery library. Specifically, the parsing logic for RTP packets in RTPChannel.OnRTPPacketReceived and the STUN parsing routines within STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute fails to validate the length of input data before performing index operations.\nWhen a packet containing a malformed STUN address attribute (specifically zero to seven bytes in length) or an unexpectedly short RTP packet is processed, these functions attempt to index into the byte array without verifying if sufficient data exists to satisfy the structure of the attribute or header. This lack of validation results in index-out-of-range exceptions during the parsing phase.\nThe vulnerability is further exacerbated by the error handling implementation in UdpReceiver.EndReceiveFrom. When the parsing routines raise a non-socket exception due to the malformed input, UdpReceiver.EndReceiveFrom lacks a robust recovery mechanism and proceeds to close the underlying channel. Because the RTP/ICE socket is shared, the closure of this channel effectively terminates the entire active media session.\nThe attack flow proceeds as follows: 1) The attacker identifies the ephemeral port assigned to a SIPSorcery-based WebRTC or SIP media session. 2) The attacker crafts a malicious packet—either an RTP packet that is shorter than the minimum expected length or a STUN message containing an address attribute truncated to seven bytes or less. 3) The attacker transmits this packet to the target's exposed UDP port. 4) The SIPSorcery library receives the packet and passes it to the vulnerable parsing functions. 5) The parsing functions trigger an unhandled exception due to insufficient length checks. 6) UdpReceiver.EndReceiveFrom catches this exception and invokes a shutdown of the associated socket/channel. 7) The media session is terminated, resulting in a successful Denial of Service.\nThis attack is effective even during the early stages of ICE connectivity checks. Because the library processes these packets before performing cryptographic verification (such as DTLS handshake or STUN MESSAGE-INTEGRITY checks), the attacker does not need to bypass any security controls or provide valid credentials to influence the packet processing logic. The vulnerability is restricted to availability impact, but it provides a reliable vector for remote session disruption."
}