SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
SIPSorcery versions prior to 10.0.14 contain a vulnerability in SCTP SACK chunk parsing where attacker-controlled counts are not validated, leading to out-of-bounds reads. This causes an unhandled IndexOutOfRangeException that terminates the dedicated SCTP receive thread, resulting in a permanent denial of service of the SCTP association and all related data channels.
AI Analysis
Technical Summary
The vulnerability arises from the SctpSackChunk.ParseChunk method reading numGapAckBlocks and numDuplicateTSNs fields from an SCTP SACK chunk without validating these counts against the chunk length or receive buffer size. An attacker can send a crafted SACK chunk with maximum counts (0xFFFF), causing the parsing loops to read beyond the 262144-byte receive buffer, triggering an IndexOutOfRangeException. This exception is not caught by the recoverable handler and causes the dedicated SCTP receive thread to exit without restart, permanently disabling the SCTP association and data channels. The issue affects SIPSorcery versions up to and including 10.0.13. The root cause is unchecked buffer indexing and insufficient validation of chunk contents. The vulnerability is distinct from a prior fix addressing a different SCTP parsing issue.
Potential Impact
Exploitation results in a denial of service by permanently terminating the SCTP receive thread, which kills the SCTP association and all data channels. There is no impact on confidentiality or integrity. The service disruption persists until manual intervention or restart of the affected component.
Mitigation Recommendations
A patch is available that addresses this vulnerability. The suggested fix includes validating that the sum of fixed parameters and counts multiplied by their sizes does not exceed the chunk length before parsing loops, adding bounds checking in parsing functions, and treating the IndexOutOfRangeException as recoverable to prevent thread termination. Users should upgrade to SIPSorcery versions later than 10.0.13 to remediate this issue.
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing
Description
SIPSorcery versions prior to 10.0.14 contain a vulnerability in SCTP SACK chunk parsing where attacker-controlled counts are not validated, leading to out-of-bounds reads. This causes an unhandled IndexOutOfRangeException that terminates the dedicated SCTP receive thread, resulting in a permanent denial of service of the SCTP association and all related data channels.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the SctpSackChunk.ParseChunk method reading numGapAckBlocks and numDuplicateTSNs fields from an SCTP SACK chunk without validating these counts against the chunk length or receive buffer size. An attacker can send a crafted SACK chunk with maximum counts (0xFFFF), causing the parsing loops to read beyond the 262144-byte receive buffer, triggering an IndexOutOfRangeException. This exception is not caught by the recoverable handler and causes the dedicated SCTP receive thread to exit without restart, permanently disabling the SCTP association and data channels. The issue affects SIPSorcery versions up to and including 10.0.13. The root cause is unchecked buffer indexing and insufficient validation of chunk contents. The vulnerability is distinct from a prior fix addressing a different SCTP parsing issue.
Potential Impact
Exploitation results in a denial of service by permanently terminating the SCTP receive thread, which kills the SCTP association and all data channels. There is no impact on confidentiality or integrity. The service disruption persists until manual intervention or restart of the affected component.
Mitigation Recommendations
A patch is available that addresses this vulnerability. The suggested fix includes validating that the sum of fixed parameters and counts multiplied by their sizes does not exceed the chunk length before parsing loops, adding bounds checking in parsing functions, and treating the IndexOutOfRangeException as recoverable to prevent thread termination. Users should upgrade to SIPSorcery versions later than 10.0.13 to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jwjp-4649-v8jp
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["NuGet"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7cd3debf8831d53917fb00
Added to database: 08/12/2026, 20:13:18 UTC
Last enriched: 08/12/2026, 21:12:07 UTC
Last updated: 08/12/2026, 21:12:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.