GHSA-pfvm-w89x-94jw: Uncaught Exception in STUN Parser Causes Complete TurnServer Receive Loop Termination
Vulnerability ID: GHSA-PFVM-W89X-94JW
CVSS Score: 7.5
Published: 2026-08-12
An uncaught exception vulnerability exists in SIPSorcery's TurnServer component, where unauthenticated malformed UDP packets can crash the core UDP receive loop, resulting in a persistent Denial of Service.
TL;DR
A single malformed pre-authentication UDP packet crashes the SIPSorcery TURN server's fire-and-forget receive thread, disabling UDP relaying for all clients until manual restart.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-248
- Attack Vector: Network
- CVSS: 7.5 (High)
- Exploit Status: PoC Released
- Impact: Complete Denial of Service
Affected Systems
- SIPSorcery TurnServer
-
SIPSorcery: >= 10.0.5, <= 10.0.13 (Fixed in:
10.0.14)
Code Analysis
Commit: ccb0b5a
Isolate UDP and TCP client processing inside local try-catch blocks to prevent uncaught exceptions from breaking the receive loops.
Exploit Details
- GitHub Security Advisory GHSA-pfvm-w89x-94jw: Vulnerability disclosure and PoC description identifying the 4-byte malformed UDP payload crash vector.
Mitigation Strategies
- Upgrade SIPSorcery to version 10.0.14 or higher
- Deploy network-level IP whitelisting to restrict access to authorized clients
- Implement application-level container restart policies (e.g., Kubernetes Liveness Probes)
Remediation Steps:
- Open your .NET project configuration or dependency manager.
- Update the SIPSorcery package reference to version '10.0.14'.
- Recompile and redeploy the updated server application.
- Validate the fix by attempting to send a non-standard 4-byte UDP sequence to the server port, ensuring the service survives.
References
- GHSA-pfvm-w89x-94jw Security Advisory
- SIPSorcery Source Code Repository
- NuGet SIPSorcery Version 10.0.14 Release
Read the full report for GHSA-PFVM-W89X-94JW on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)