Executive brief
TeamSpeak 3 Server and SDK are affected by a vulnerability that can cause the communication service to crash or restart. This occurs when the server receives a specifically crafted network request during the initial connection phase. An exploit would result in a denial-of-service, preventing users from connecting to or using the voice communication platform.
Technical details
The vulnerability is classified as a Reachable Assertion (CWE-617) within the 'clientek Handshake Handler' component. It is triggered by manipulating the 'proof' argument during the handshake process. An unauthenticated remote attacker can send a specially crafted network request that causes the server to fail an internal assertion check, leading to a process crash or restart (Denial of Service). The issue is resolved in TeamSpeak 3 Server version 3.13.8 and TeamSpeak SDK version 3.5.0.
Affected products
- TeamSpeak TeamSpeak 3 Server <= 3.13.7
- TeamSpeak TeamSpeak SDK (Server-Side Integrations) <= 3.3.1
Timeline
- 2026-05-27: disclosed: Coordinated disclosure by modzero and TeamSpeak
- 2026-05-27: patched: TeamSpeak 3 Server 3.13.8 and SDK 3.5.0 released
- 2026-05-27: advisory