{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sipsorcery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SIPSorcery"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SIPSorcery"],"content_html":"\u003cp\u003eSIPSorcery versions 10.0.13 and earlier are susceptible to a permanent denial of service condition in the SCTP stack. The \u003ccode\u003eSctpSackChunk.ParseChunk\u003c/code\u003e method reads the \u003ccode\u003enumGapAckBlocks\u003c/code\u003e and \u003ccode\u003enumDuplicateTSNs\u003c/code\u003e counts directly from an attacker-controlled SCTP SACK chunk without validating these values against the actual length of the receive buffer.\u003c/p\u003e\n\u003cp\u003eBy providing specifically crafted values, an attacker can force the application to perform reads past the boundary of the 262144-byte receive buffer. This operation triggers an \u003ccode\u003eIndexOutOfRangeException\u003c/code\u003e. Because the library handles this exception using a generic catch block that breaks the receive loop rather than a recoverable handler, the dedicated SCTP receive thread is terminated and fails to restart. This results in the immediate and permanent loss of the SCTP association and all associated WebRTC data channels.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker establishes a post-DTLS negotiated WebRTC connection with a target running a vulnerable SIPSorcery version.\u003c/li\u003e\n\u003cli\u003eThe attacker constructs a malicious SCTP packet containing a SACK chunk (type 3).\u003c/li\u003e\n\u003cli\u003eThe attacker sets the \u003ccode\u003echunkLength\u003c/code\u003e to a valid value (e.g., 16) to pass initial \u003ccode\u003eSctpPacket.ParseChunks\u003c/code\u003e sanity checks.\u003c/li\u003e\n\u003cli\u003eThe attacker sets \u003ccode\u003enumGapAckBlocks\u003c/code\u003e to 0xFFFF, forcing the parser into an oversized iteration loop.\u003c/li\u003e\n\u003cli\u003eThe attacker computes a valid CRC32C checksum to bypass the network-level verification stage of the SCTP packet.\u003c/li\u003e\n\u003cli\u003eThe SIPSorcery library reads the crafted count into the gap-ack processing loop within \u003ccode\u003eSctpSackChunk.ParseChunk\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe loop accesses index 262144 of the 262144-byte buffer, triggering an \u003ccode\u003eIndexOutOfRangeException\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe exception propagates to the generic \u003ccode\u003ecatch\u003c/code\u003e block in \u003ccode\u003eRTCSctpTransport.DoReceive\u003c/code\u003e, which executes a \u003ccode\u003ebreak\u003c/code\u003e statement and permanently terminates the receive thread.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a complete and permanent denial of service for any affected SCTP association. All data channels associated with the connection are dropped and the service cannot recover without a manual restart of the impacted thread or service, depending on implementation. This impacts all applications utilizing SIPSorcery for WebRTC transport.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDetection and mitigation should focus on identifying malformed SCTP traffic or application-level thread stability.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate SIPSorcery to a patched version that implements bounds checking for \u003ccode\u003enumGapAckBlocks\u003c/code\u003e and \u003ccode\u003enumDuplicateTSNs\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement application-level monitoring for the termination of the \u003ccode\u003e_receiveThread\u003c/code\u003e in \u003ccode\u003eRTCSctpTransport\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediate, deploy network security controls to inspect and drop SCTP packets with suspicious chunk parameters if the environment supports deep packet inspection for WebRTC protocols.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T22:48:41Z","date_published":"2026-08-12T22:48:41Z","id":"https://feed.craftedsignal.io/briefs/2026-08-sipsorcery-dos/","summary":"The SIPSorcery library is vulnerable to a denial of service via a crafted SCTP SACK chunk that causes an out-of-bounds read and subsequent termination of the SCTP receive thread.","title":"SIPSorcery Denial of Service via SCTP SACK Chunk OOB Read","url":"https://feed.craftedsignal.io/briefs/2026-08-sipsorcery-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - SIPSorcery","version":"https://jsonfeed.org/version/1.1"}