CVE-2026-54632
Received Received - Intake

Denial of Service in SIPSorcery Library

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while UdpReceiver.EndReceiveFrom closes the channel when those operations raise a non-socket exception. A remote party can send a single short RTP packet or malformed zero-to-seven-byte STUN address attribute to the shared RTP/ICE socket, including during ICE connectivity checks before DTLS or STUN MESSAGE-INTEGRITY verification, and terminate the active RTP or WebRTC media session. The attacker must reach or learn the advertised ephemeral RTP/ICE port, but no authentication or user interaction is required, and the impact is limited to availability. This issue is fixed in version 10.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54632

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sipsorcery sipsorcery to 10.0.9 (exc)
sipsorcery sipsorcery 10.0.9
sipsorcery sipsorcery to 10.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to version 10.0.9, it had a vulnerability where RTPChannel.OnRTPPacketReceived and STUNAttribute parsing methods did not perform sufficient length checks on untrusted bytes. This allowed a remote attacker to send a short RTP packet or a malformed STUN address attribute to terminate active RTP or WebRTC media sessions by exploiting exceptions in the parsing path.

Detection Guidance

This vulnerability involves insufficient length checks in RTP and STUN packet parsing, leading to potential session termination. Monitor for unexpected RTP or STUN packet drops or malformed packets on UDP ports used by SIPSorcery. Use packet capture tools like tcpdump or Wireshark to inspect traffic for short RTP packets or malformed STUN attributes.

Impact Analysis

This vulnerability can impact you by allowing an attacker to terminate your active RTP or WebRTC media sessions. The attacker only needs to reach or learn the ephemeral RTP/ICE port, and no authentication or user interaction is required. The impact is limited to availability, meaning your media sessions may be disrupted.

Compliance Impact

This vulnerability primarily impacts availability by allowing remote termination of RTP or WebRTC media sessions through a denial-of-service (DoS) attack. It does not directly affect confidentiality or integrity of data. For compliance standards like GDPR or HIPAA, which emphasize data protection and availability, this issue could lead to service disruptions but does not inherently violate these regulations unless such disruptions result in unauthorized access or data loss.

Mitigation Strategies

Upgrade SIPSorcery to version 10.0.9 or later to address the vulnerability. If upgrading is not immediately possible, restrict network access to the RTP/ICE ports using firewalls to limit exposure. Monitor for unusual traffic patterns that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart