https://vulnerability.circl.lu/sightings/feed 2026-08-14T12:02:45.168273+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/83cfb9f3-2a72-4fd0-be6f-41dbfd106830/export 2026-08-14T12:02:45.182716+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "83cfb9f3-2a72-4fd0-be6f-41dbfd106830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-pfvm-w89x-94jw", "type": "seen", "source": "https://gist.github.com/alon710/05e3ea6ef79e0a47d082b88eec33ae87", "content": "# GHSA-PFVM-W89X-94JW: GHSA-pfvm-w89x-94jw: Uncaught Exception in STUN Parser Causes Complete TurnServer Receive Loop Termination\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/GHSA-PFVM-W89X-94JW\n\n## Summary\nAn uncaught exception vulnerability exists in SIPSorcery's TurnServer component, where unauthenticated malformed UDP packets can crash the core UDP receive loop, resulting in a persistent Denial of Service.\n\n## TL;DR\nA single malformed pre-authentication UDP packet crashes the SIPSorcery TURN server's fire-and-forget receive thread, disabling UDP relaying for all clients until manual restart.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248\n- **Attack Vector**: Network\n- **CVSS**: 7.5 (High)\n- **Exploit Status**: PoC Released\n- **Impact**: Complete Denial of Service\n\n## Affected Systems\n\n- SIPSorcery TurnServer\n- **SIPSorcery**: >= 10.0.5, <= 10.0.13 (Fixed in: `10.0.14`)\n\n## Mitigation\n\n- Upgrade SIPSorcery to version 10.0.14 or higher\n- Deploy network-level IP whitelisting to restrict access to authorized clients\n- Implement application-level container restart policies (e.g., Kubernetes Liveness Probes)\n\n**Remediation Steps:**\n1. Open your .NET project configuration or dependency manager.\n2. Update the SIPSorcery package reference to version '10.0.14'.\n3. Recompile and redeploy the updated server application.\n4. Validate the fix by attempting to send a non-standard 4-byte UDP sequence to the server port, ensuring the service survives.\n\n## References\n\n- [GHSA-pfvm-w89x-94jw Security Advisory](https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-pfvm-w89x-94jw)\n- [SIPSorcery Source Code Repository](https://github.com/sipsorcery-org/sipsorcery)\n- [NuGet SIPSorcery Version 10.0.14 Release](https://www.nuget.org/packages/SIPSorcery/10.0.14)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PFVM-W89X-94JW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T20:31:49.649204Z"} 2026-08-12T20:31:49.649204+00:00