SIPSorcery TurnServer denial of service via malformed UDP datagram

Executive brief

A vulnerability in the SIPSorcery library's TURN server component allows a remote attacker to crash the communication service by sending a single specially crafted network packet. This component is responsible for relaying media traffic between users; if crashed, all active and new connections for all users will fail until the server is manually restarted. This results in a complete denial of service for the affected communication features.

Technical details

The TurnServer.ReceiveUdpAsync method in SIPSorcery (versions 10.0.5 through 10.0.13) contains a logic error where the primary packet processing logic (HandleUdpDatagram) resides outside of the try-catch block within its receive loop. An unauthenticated attacker can send a UDP datagram with a specific first byte (0x80–0xFF) that triggers an ApplicationException during STUN header parsing. Because the exception is caught outside the loop, the receive thread terminates without a supervisor to restart it, effectively disabling the TURN UDP relay for all clients. The issue is fixed in version 10.0.14 by ensuring exceptions during packet processing do not terminate the listener loop.

Affected products

• SIPSorcery SIPSorcery 10.0.5 - 10.0.13

Timeline

• 2026-08-12: advisory: GHSA-pfvm-w89x-94jw published
• 2026-08-12: patched: Fixed in version 10.0.14

References

• https://api.github.com/users/manus-use
• https://github.com/manus-use
• https://api.github.com/users/manus-use/gists%7B/gist_id%7D
• https://api.github.com/users/manus-use/repos
• https://avatars.githubusercontent.com/u/213290975?v=4
• https://api.github.com/users/manus-use/events%7B/privacy%7D