https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 18 Aug 2026 22:21:19 +0000 https://vulnerability.circl.lu/sighting/a5425d49-f2bb-4fe4-b4da-26729465f2f9/export {"uuid": "a5425d49-f2bb-4fe4-b4da-26729465f2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jwjp-4649-v8jp", "type": "seen", "source": "https://gist.github.com/alon710/888eb8510aa54f9402838aff0f641752", "content": "# GHSA-JWJP-4649-V8JP: GHSA-jwjp-4649-v8jp: Out-of-Bounds Read in SIPSorcery SCTP SACK Chunk Parsing\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/GHSA-JWJP-4649-V8JP\n\n## Summary\nAn out-of-bounds read vulnerability in the SCTP SACK chunk parser of SIPSorcery leads to Denial of Service (DoS) or silent internal state corruption due to lack of boundary validation on incoming chunk elements.\n\n## TL;DR\nUnchecked Gap Ack Block and Duplicate TSN counts in SIPSorcery SCTP SACK chunk parsing permit out-of-bounds reads, crashing the receive thread and causing a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 / CWE-248\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS) / State Corruption\n- **Exploit Status**: Proof-of-Concept\n- **Affected Component**: SctpSackChunk.ParseChunk\n\n## Affected Systems\n\n- SIPSorcery C# .NET WebRTC Library\n- **SIPSorcery**: < commit a2466550bb2a28821c73fb1961bc33dcc467f8cf (Fixed in: `commit a2466550bb2a28821c73fb1961bc33dcc467f8cf`)\n\n## Mitigation\n\n- Upgrade SIPSorcery dependency to a patched version containing PR #1772.\n- Implement network-level packet validation for SCTP packets.\n- Configure active health checks for WebRTC Data Channels to automatically restart stalled transport instances.\n\n**Remediation Steps:**\n1. Identify all C# projects using the SIPSorcery NuGet package.\n2. Update the package reference in .csproj to the latest stable version or a version including commit a2466550bb2a28821c73fb1961bc33dcc467f8cf.\n3. Rebuild the application and deploy the updated binaries.\n4. Verify that SCTP SACK chunk parsing tests pass in the build environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-jwjp-4649-v8jp](https://github.com/advisories/GHSA-jwjp-4649-v8jp)\n- [SIPSorcery Pull Request #1772](https://github.com/sipsorcery-org/sipsorcery/pull/1772)\n- [Official Fix Commit](https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JWJP-4649-V8JP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T21:32:04.433253Z"} {"uuid": "a5425d49-f2bb-4fe4-b4da-26729465f2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jwjp-4649-v8jp", "type": "seen", "source": "https://gist.github.com/alon710/888eb8510aa54f9402838aff0f641752", "content": "# GHSA-JWJP-4649-V8JP: GHSA-jwjp-4649-v8jp: Out-of-Bounds Read in SIPSorcery SCTP SACK Chunk Parsing\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/GHSA-JWJP-4649-V8JP\n\n## Summary\nAn out-of-bounds read vulnerability in the SCTP SACK chunk parser of SIPSorcery leads to Denial of Service (DoS) or silent internal state corruption due to lack of boundary validation on incoming chunk elements.\n\n## TL;DR\nUnchecked Gap Ack Block and Duplicate TSN counts in SIPSorcery SCTP SACK chunk parsing permit out-of-bounds reads, crashing the receive thread and causing a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 / CWE-248\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS) / State Corruption\n- **Exploit Status**: Proof-of-Concept\n- **Affected Component**: SctpSackChunk.ParseChunk\n\n## Affected Systems\n\n- SIPSorcery C# .NET WebRTC Library\n- **SIPSorcery**: < commit a2466550bb2a28821c73fb1961bc33dcc467f8cf (Fixed in: `commit a2466550bb2a28821c73fb1961bc33dcc467f8cf`)\n\n## Mitigation\n\n- Upgrade SIPSorcery dependency to a patched version containing PR #1772.\n- Implement network-level packet validation for SCTP packets.\n- Configure active health checks for WebRTC Data Channels to automatically restart stalled transport instances.\n\n**Remediation Steps:**\n1. Identify all C# projects using the SIPSorcery NuGet package.\n2. Update the package reference in .csproj to the latest stable version or a version including commit a2466550bb2a28821c73fb1961bc33dcc467f8cf.\n3. Rebuild the application and deploy the updated binaries.\n4. Verify that SCTP SACK chunk parsing tests pass in the build environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-jwjp-4649-v8jp](https://github.com/advisories/GHSA-jwjp-4649-v8jp)\n- [SIPSorcery Pull Request #1772](https://github.com/sipsorcery-org/sipsorcery/pull/1772)\n- [Official Fix Commit](https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JWJP-4649-V8JP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T21:32:04.433253Z"} https://vulnerability.circl.lu/sighting/a5425d49-f2bb-4fe4-b4da-26729465f2f9/export Wed, 12 Aug 2026 21:32:04 +0000