GHSA-jwjp-4649-v8jp: Out-of-Bounds Read in SIPSorcery SCTP SACK Chunk Parsing
Vulnerability ID: GHSA-JWJP-4649-V8JP
CVSS Score: 7.5
Published: 2026-08-12
An out-of-bounds read vulnerability in the SCTP SACK chunk parser of SIPSorcery leads to Denial of Service (DoS) or silent internal state corruption due to lack of boundary validation on incoming chunk elements.
TL;DR
Unchecked Gap Ack Block and Duplicate TSN counts in SIPSorcery SCTP SACK chunk parsing permit out-of-bounds reads, crashing the receive thread and causing a denial of service.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-125 / CWE-248
- Attack Vector: Network
- CVSS v3.1 Score: 7.5 (High)
- Impact: Denial of Service (DoS) / State Corruption
- Exploit Status: Proof-of-Concept
- Affected Component: SctpSackChunk.ParseChunk
Affected Systems
- SIPSorcery C# .NET WebRTC Library
-
SIPSorcery: < commit a2466550bb2a28821c73fb1961bc33dcc467f8cf (Fixed in:
commit a2466550bb2a28821c73fb1961bc33dcc467f8cf)
Code Analysis
Commit: a246655
Fix SCTP out-of-bounds reads in SACK chunk parsing by validating required length against declared length and catching exception types.
Mitigation Strategies
- Upgrade SIPSorcery dependency to a patched version containing PR #1772.
- Implement network-level packet validation for SCTP packets.
- Configure active health checks for WebRTC Data Channels to automatically restart stalled transport instances.
Remediation Steps:
- Identify all C# projects using the SIPSorcery NuGet package.
- Update the package reference in .csproj to the latest stable version or a version including commit a2466550bb2a28821c73fb1961bc33dcc467f8cf.
- Rebuild the application and deploy the updated binaries.
- Verify that SCTP SACK chunk parsing tests pass in the build environment.
References
Read the full report for GHSA-JWJP-4649-V8JP on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)