{"answers":{"affected":"2 open source packages ship an affected version, including SIPSorcery.","exploited":"There is no known exploitation of GHSA-pfvm-w89x-94jw in the wild and no public exploit code.","fix":"Upgrade SIPSorcery to 10.0.14 or later.","what":"GHSA-pfvm-w89x-94jw is a denial of service vulnerability in SIPSorcery, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-pfvm-w89x-94jw and fix it if it is affected.\n\nWhat it is: GHSA-pfvm-w89x-94jw is a denial of service vulnerability in SIPSorcery, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-pfvm-w89x-94jw in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- SIPSorcery (NuGet): affected from 10.0.5; fixed in 10.0.14\n- SIPSorcery (NuGet): affected from 10.0.5; fixed in 10.0.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/ (Markdown: https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/index.md)","id":"GHSA-pfvm-w89x-94jw","markdown":"https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/index.md","name":"GHSA-pfvm-w89x-94jw","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SIPSorcery TURN server","requires_auth":"none","summary":"A malformed UDP packet crashes the SIPSorcery TURN server receive loop, causing a permanent denial of service for all clients without authentication.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n`TurnServer.ReceiveUdpAsync` places its generic `catch (Exception)` OUTSIDE the `while` receive loop, and `Start()` launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in `0x80–0xFF` causes `STUNHeader.ParseSTUNHeader` to throw `ApplicationException`, which unwinds past the loop and terminates it. The TURN UDP relay is then dead for ALL clients until the process is restarted.\n\n## Root Cause\n`src/SIPSorcery/net/TURN/TurnServer.cs`:\n- `ReceiveUdpAsync` (:555-577): the inner `try` (:562-567) wraps only `_udpSocket.ReceiveAsync()`; `HandleUdpDatagram(result.Buffer, result.RemoteEndPoint)` (:569) is inside the `while` body but OUTSIDE that inner try. The generic `catch (Exception ex)` (:573) is lexically OUTSIDE the `while`.\n- `Start()` does `_ = ReceiveUdpAsync();` (:381) — fire-and-forget, no restart.\n- `HandleUdpDatagram` (:579) calls `STUNMessage.ParseSTUNMessage(data, data.Length)` (:600) for any non-ChannelData datagram; `ParseSTUNMessage` (STUNMessage.cs:94) has no try/catch.\n\n## Impact\n`ApplicationException` propagates out of the `while`, is caught at :573, logged, and the method returns. `_running` remains true but nothing re-invokes `ReceiveUdpAsync` → TURN UDP relay permanently unavailable for all clients (whole-server DoS). Pre-authentication: STUN parsing precedes any TURN allocation/credential check.\n\n## Proof of Concept\nSend one UDP datagram to the TURN port (default 3478) with first byte `0x80` (e.g. `80 00 00 00`). `0x80 \u0026 0xC0 = 0x80 ≠ 0x40` → not ChannelData → `ParseSTUNMessage` → `ParseSTUNHeader` executes `if ((Array[startIndex] \u0026 0xC0) != 0) throw new ApplicationException(...)` (STUNHeader.cs:169-172); `0x80 \u0026 0xC0 = 0x80 ≠ 0` → throws.\n\n## Attack Chain\n1. Entry: one UDP datagram to the TURN port, first byte `0x80–0xFF`. Guard: ChannelData branch requires `(data[0] \u0026 0xC0) == 0x40` (:583). Bypass: `0x80 \u0026 0xC0 = 0x80 ≠ 0x40` → falls through to `ParseSTUNMessage` (:600).\n2. Sink: `STUNMessage.ParseSTUNMessage` → `STUNHeader.ParseSTUNHeader` (STUNHeader.cs:169-172) throws `ApplicationException`. Guard: none before the throw; `ParseSTUNMessage` has no try/catch. Bypass: `0x80 \u0026 0xC0 = 0x80 ≠ 0` → throws.\n3. Impact: exception unwinds past the `while` into `catch(Exception)` at :573 → logged → method returns → loop exits. Guard: none — no restart (`Start()` :381 fire-and-forget). Bypass: N/A. TURN UDP relay dead for all clients until process restart.\n\n## Bypass Evidence\n- Loop/catch structure: catch at TurnServer.cs:573 is outside the `while` at :559; `HandleUdpDatagram` at :569 is outside the inner try (:562-567).\n- Unguarded `ParseSTUNMessage` at :600; throw at STUNHeader.cs:169-172.\n- Fire-and-forget start at :381 with no restart in `Start()`.\n- `TurnServerConfig.ListenAddress` defaults to `IPAddress.Loopback` (:42), but a functioning TURN server must bind a routable address to serve clients, so real deployments are exposed. Non-default config narrows the vulnerable population, not the attack difficulty → AC:L.\n\n## Affected Versions\n`nuget:SIPSorcery \u003c= 10.0.13` (TurnServer component present since 10.0.5; verified on release tag v10.0.13 and HEAD).\n\n## Dedup\nNOT a duplicate of GHSA-28gm-jrmw-xx93 (CVE-2026-54632), which covers the client RTP/ICE socket (`UdpReceiver`/`RTPChannel`). `TurnServer` is a distinct shipped RFC 5766 server component with its own loop and fix location.\n\n## Suggested Fix\nWrap `HandleUdpDatagram` in a per-datagram try/log-and-continue INSIDE the `while` (matching the drop-and-continue intent of fix bdb76cb), and/or add loop supervision/restart.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","ecosystems":["NuGet"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"`TurnServer.ReceiveUdpAsync` places its generic `catch (Exception)` OUTSIDE the `while` receive loop, and `Start()` launches the","id":"GHSA-pfvm-w89x-94jw","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"NuGet","fixed":["10.0.14"],"introduced":["10.0.5"],"last_affected":[],"package":"SIPSorcery","purl":null,"source":"GHSA-pfvm-w89x-94jw"},{"ecosystem":"NuGet","fixed":["10.0.14"],"introduced":["10.0.5"],"last_affected":[],"package":"SIPSorcery","purl":"pkg:nuget/SIPSorcery","source":"GHSA-pfvm-w89x-94jw"}],"products":null,"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malformed UDP packet crashes the SIPSorcery TURN server receive loop, causing a permanent denial of service for all clients without authentication.","url":"https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/"}