The TurnServer.ReceiveUdpAsync method in SIPSorcery places its generic exception handler outside the UDP receive loop. When a single UDP datagram with a STUN header first byte in the range 0x80–0xFF is received, STUNHeader.ParseSTUNHeader throws an ApplicationException that unwinds past the loop and terminates it. Since the receive loop is started fire-and-forget with no supervision or restart, the TURN UDP relay becomes permanently unavailable for all clients until the process is restarted. This is a denial of service vulnerability affecting SIPSorcery versions >=10.0.5 and <10.0.14.

An attacker can send a single malformed UDP datagram to the TURN port (default 3478) that triggers an unhandled ApplicationException, causing the UDP receive loop to exit and disabling the TURN UDP relay for all clients. This results in a denial of service affecting all clients relying on the TURN UDP relay until the server process is manually restarted. The vulnerability is exploitable without authentication and requires only network access to the TURN port.

A patch is available for this vulnerability. The recommended fix is to wrap the HandleUdpDatagram call in a per-datagram try/catch block inside the receive loop to prevent exceptions from terminating the loop, and/or to add supervision and automatic restart of the receive loop. Until patched, manual process restart is required to recover from the denial of service. Check the vendor advisory or official SIPSorcery repository for the patch and update to version 10.0.14 or later.