# GHSA-pfvm-w89x-94jw: `TurnServer.ReceiveUdpAsync` places its generic `catch (Exception)` OUTSIDE the `while` receive loop, and `Start()` launches the

> A malformed UDP packet crashes the SIPSorcery TURN server receive loop, causing a permanent denial of service for all clients without authentication.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 12 Aug 2026

## What is GHSA-pfvm-w89x-94jw?

GHSA-pfvm-w89x-94jw is a denial of service vulnerability in SIPSorcery, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Summary
`TurnServer.ReceiveUdpAsync` places its generic `catch (Exception)` OUTSIDE the `while` receive loop, and `Start()` launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in `0x80–0xFF` causes `STUNHeader.ParseSTUNHeader` to throw `ApplicationException`, which unwinds past the loop and terminates it. The TURN UDP relay is then dead for ALL clients until the process is restarted.

## Root Cause
`src/SIPSorcery/net/TURN/TurnServer.cs`:
- `ReceiveUdpAsync` (:555-577): the inner `try` (:562-567) wraps only `_udpSocket.ReceiveAsync()`; `HandleUdpDatagram(result.Buffer, result.RemoteEndPoint)` (:569) is inside the `while` body but OUTSIDE that inner try. The generic `catch (Exception ex)` (:573) is lexically OUTSIDE the `while`.
- `Start()` does `_ = ReceiveUdpAsync();` (:381) — fire-and-forget, no restart.
- `HandleUdpDatagram` (:579) calls `STUNMessage.ParseSTUNMessage(data, data.Length)` (:600) for any non-ChannelData datagram; `ParseSTUNMessage` (STUNMessage.cs:94) has no try/catch.

## Impact
`ApplicationException` propagates out of the `while`, is caught at :573, logged, and the method returns. `_running` remains true but nothing re-invokes `ReceiveUdpAsync` → TURN UDP relay permanently unavailable for all clients (whole-server DoS). Pre-authentication: STUN parsing precedes any TURN allocation/credential check.

## Proof of Concept
Send one UDP datagram to the TURN port (default 3478) with first byte `0x80` (e.g. `80 00 00 00`). `0x80 & 0xC0 = 0x80 ≠ 0x40` → not ChannelData → `ParseSTUNMessage` → `ParseSTUNHeader` executes `if ((Array[startIndex] & 0xC0) != 0) throw new ApplicationException(...)` (STUNHeader.cs:169-172); `0x80 & 0xC0 = 0x80 ≠ 0` → throws.

## Attack Chain
1. Entry: one UDP datagram to the TURN port, first byte `0x80–0xFF`. Guard: ChannelData branch requires `(data[0] & 0xC0) == 0x40` (:583). Bypass: `0x80 & 0xC0 = 0x80 ≠ 0x40` → falls through to `ParseSTUNMessage` (:600).
2. Sink: `STUNMessage.ParseSTUNMessage` → `STUNHeader.ParseSTUNHeader` (STUNHeader.cs:169-172) throws `ApplicationException`. Guard: none before the throw; `ParseSTUNMessage` has no try/catch. Bypass: `0x80 & 0xC0 = 0x80 ≠ 0` → throws.
3. Impact: exception unwinds past the `while` into `catch(Exception)` at :573 → logged → method returns → loop exits. Guard: none — no restart (`Start()` :381 fire-and-forget). Bypass: N/A. TURN UDP relay dead for all clients until process restart.

## Bypass Evidence
- Loop/catch structure: catch at TurnServer.cs:573 is outside the `while` at :559; `HandleUdpDatagram` at :569 is outside the inner try (:562-567).
- Unguarded `ParseSTUNMessage` at :600; throw at STUNHeader.cs:169-172.
- Fire-and-forget start at :381 with no restart in `Start()`.
- `TurnServerConfig.ListenAddress` defaults to `IPAddress.Loopback` (:42), but a functioning TURN server must bind a routable address to serve clients, so real deployments are exposed. Non-default config narrows the vulnerable population, not the attack difficulty → AC:L.

## Affected Versions
`nuget:SIPSorcery <= 10.0.13` (TurnServer component present since 10.0.5; verified on release tag v10.0.13 and HEAD).

## Dedup
NOT a duplicate of GHSA-28gm-jrmw-xx93 (CVE-2026-54632), which covers the client RTP/ICE socket (`UdpReceiver`/`RTPChannel`). `TurnServer` is a distinct shipped RFC 5766 server component with its own loop and fix location.

## Suggested Fix
Wrap `HandleUdpDatagram` in a per-datagram try/log-and-continue INSIDE the `while` (matching the drop-and-continue intent of fix bdb76cb), and/or add loop supervision/restart.

---
Reported by **zx (Jace)** — GitHub: @manus-use

## Which versions are affected by GHSA-pfvm-w89x-94jw?

2 open source packages ship an affected version, including SIPSorcery.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `SIPSorcery` | NuGet | From 10.0.5 | 10.0.14 |
| `SIPSorcery` | NuGet | From 10.0.5 | 10.0.14 |

## How do I fix GHSA-pfvm-w89x-94jw?

Upgrade SIPSorcery to 10.0.14 or later.

## Is GHSA-pfvm-w89x-94jw being exploited?

There is no known exploitation of GHSA-pfvm-w89x-94jw in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-pfvm-w89x-94jw and fix it if it is affected.

What it is: GHSA-pfvm-w89x-94jw is a denial of service vulnerability in SIPSorcery, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-pfvm-w89x-94jw in the wild and no public exploit code.

Affected packages and fixed versions:
- SIPSorcery (NuGet): affected from 10.0.5; fixed in 10.0.14
- SIPSorcery (NuGet): affected from 10.0.5; fixed in 10.0.14

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/ (Markdown: https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-pfvm-w89x-94jw

---
From sbomify Insights: https://insights.sbomify.com/GHSA-pfvm-w89x-94jw/
Summaries are generated and may contain mistakes; the official description above is the record.