{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/sipsorcery/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SIPSorcery (\u003c= 10.0.8)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","nuget","sipsorcery"],"_cs_type":"advisory","_cs_vendors":["SIPSorcery"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability, tracked as CVE-2026-54632, affects versions of the SIPSorcery NuGet package up to and including 10.0.8. An unauthenticated attacker can exploit this flaw by sending a single malformed UDP packet to a vulnerable SIPSorcery RTP/ICE socket. The vulnerability stems from inadequate length checks when processing packet data and STUN attributes, which can lead to runtime exceptions such as \u003ccode\u003eIndexOutOfRangeException\u003c/code\u003e or \u003ccode\u003eNullReferenceException\u003c/code\u003e. Crucially, the UDP receive loop in \u003ccode\u003eUdpReceiver.EndReceiveFrom\u003c/code\u003e incorrectly responds to these exceptions by closing the entire channel rather than merely discarding the problematic packet. This systemic flaw allows a single, small, unauthenticated packet to terminate an active RTP or WebRTC media session, causing a Denial of Service. The issue is reachable during ICE connectivity checks, even before DTLS handshakes or STUN \u003ccode\u003eMESSAGE-INTEGRITY\u003c/code\u003e verification.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a specially malformed UDP packet (e.g., a 1-byte packet or a STUN message with a short \u003ccode\u003eXOR-MAPPED-ADDRESS\u003c/code\u003e attribute length of 0-7 bytes).\u003c/li\u003e\n\u003cli\u003eThe attacker sends this malformed UDP packet to the target SIPSorcery RTP/ICE socket, whose port is typically advertised during ICE candidate exchange.\u003c/li\u003e\n\u003cli\u003eThe SIPSorcery application's \u003ccode\u003eUdpReceiver\u003c/code\u003e receives the packet and passes it for processing to \u003ccode\u003eRTPChannel.OnRTPPacketReceived\u003c/code\u003e or \u003ccode\u003eSTUNAttribute.ParseMessageAttributes\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to insufficient length validation in these parsing routines, the application attempts to index untrusted bytes beyond the packet's bounds or with null values, leading to an \u003ccode\u003eIndexOutOfRangeException\u003c/code\u003e or \u003ccode\u003eNullReferenceException\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eUdpReceiver.EndReceiveFrom\u003c/code\u003e method, which manages the UDP receive loop, catches this application exception within a general \u003ccode\u003ecatch-all\u003c/code\u003e block.\u003c/li\u003e\n\u003cli\u003eInstead of logging the error, dropping the malformed packet, and continuing the receive loop, the \u003ccode\u003ecatch-all\u003c/code\u003e block incorrectly invokes \u003ccode\u003eClose()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe invocation of \u003ccode\u003eClose()\u003c/code\u003e forcefully tears down the active RTP or WebRTC media session channel, resulting in a complete Denial of Service for the affected communication.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of CVE-2026-54632 is a complete Denial of Service for active RTP or WebRTC media sessions utilizing vulnerable SIPSorcery instances. A single, small, unauthenticated malformed UDP packet is sufficient to terminate an ongoing session. There is no observed loss of confidentiality or integrity. While exposure is lower for blind off-path attackers who must first discover ephemeral ports, peer or on-path attackers can easily exploit this vulnerability. Organizations relying on SIPSorcery for VoIP, WebRTC, or other media communication could experience significant service disruptions, failed calls, and communication outages.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eSIPSorcery\u003c/code\u003e NuGet package to version \u003ccode\u003e10.0.9\u003c/code\u003e or later immediately to patch CVE-2026-54632.\u003c/li\u003e\n\u003cli\u003eAs a temporary workaround for CVE-2026-54632, restrict access to the RTP/ICE port at the network layer to only known and trusted peers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:02:19Z","date_published":"2026-07-28T17:02:19Z","id":"https://feed.craftedsignal.io/briefs/2026-07-sipsorcery-dos/","summary":"A denial-of-service vulnerability (CVE-2026-54632) exists in the SIPSorcery NuGet package versions \u003c= 10.0.8, allowing an unauthenticated attacker to remotely terminate an active RTP or WebRTC media session by sending a single malformed inbound UDP packet to the RTP/ICE socket, which exploits insufficient length checks and an exception handling flaw.","title":"SIPSorcery: Malformed UDP Packet Can Remotely Terminate Media Sessions (DoS)","url":"https://feed.craftedsignal.io/briefs/2026-07-sipsorcery-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Sipsorcery","version":"https://jsonfeed.org/version/1.1"}