CVE-2026-54632: SIPSorcery WebRTC Library DOS Vulnerability

CVE-2026-54632 Overview

CVE-2026-54632 is a denial-of-service vulnerability in SIPSorcery, a WebRTC, SIP, and VoIP library for C# and .NET. Versions prior to 10.0.9 fail to enforce sufficient length checks when parsing RTP packets and STUN address attributes. A remote party can send a single short RTP packet or a malformed zero-to-seven-byte STUN address attribute to the shared RTP/ICE socket and terminate the active media session. The attack works during ICE connectivity checks before DTLS or STUN MESSAGE-INTEGRITY verification, so no authentication or user interaction is required. The attacker must reach or learn the advertised ephemeral RTP/ICE port. Impact is limited to availability of the media session.

Critical Impact
A single malformed packet can terminate any active RTP or WebRTC media session handled by an unpatched SIPSorcery instance, with no authentication required.

Affected Products

SIPSorcery library versions prior to 10.0.9
C# and .NET applications embedding vulnerable SIPSorcery WebRTC components
VoIP and SIP services using the vulnerable RTP/ICE channel implementation

Discovery Timeline

2026-09-14 - CVE-2026-54632 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54632

Vulnerability Analysis

The vulnerability is an input validation flaw [CWE-20] in the RTP/ICE receive path of SIPSorcery. The RTPChannel.OnRTPPacketReceived method and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsers index into untrusted byte buffers without verifying that enough bytes remain. When these operations raise a non-socket exception, UdpReceiver.EndReceiveFrom responds by closing the underlying channel. The combined behavior converts a parser exception on a single malformed packet into a full teardown of the RTP or WebRTC session. Because the shared RTP/ICE socket accepts packets before DTLS handshakes complete and before STUN MESSAGE-INTEGRITY verification succeeds, any remote party that can reach the ephemeral port can trigger the condition.

Root Cause

Two defects combine. First, the packet handlers dereference bytes beyond validated bounds when a packet is shorter than the minimum size for any multiplexed protocol on the RTP/ICE port. Second, UdpReceiver.EndReceiveFrom treats all non-socket exceptions as fatal and calls Close, rather than logging the error and continuing to receive.

Attack Vector

An unauthenticated remote attacker sends one short RTP packet or a malformed STUN address attribute (between zero and seven bytes) to the target's advertised RTP/ICE port. The malformed packet triggers an out-of-bounds read inside a parser, throws a non-socket exception, and the receive loop closes the socket, terminating the media session.

csharp

// Patch: src/SIPSorcery/net/RTP/RTPChannel.cs
 protected virtual void OnRTPPacketReceived(UdpReceiver receiver, int localPort, IPEndPoint remoteEndPoint, byte[] packet)
 {
-    if (packet?.Length > 0)
+    // Every protocol multiplexed on the RTP/ICE socket has a minimum size of at least an RTP header:
+    // STUN is >= 20 bytes (STUNHeader.STUN_HEADER_LENGTH), a DTLS record is >= 13 bytes, RTP is >= 12
+    // bytes (RTPHeader.MIN_HEADER_LEN) and secured RTCP (SRTCP, i.e. all WebRTC RTCP) is larger still.
+    if (packet != null && packet.Length >= RTPHeader.MIN_HEADER_LEN)
     {
         //logger.LogDebug("RTPChannel received {Length} bytes from {RemoteEndPoint}.", packet.Length, remoteEndPoint);

Source: GitHub Commit bdb76cb

Detection Methods for CVE-2026-54632

Indicators of Compromise

Repeated UdpReceiver.EndReceiveFrom exception log entries followed by session termination.
Unexpected RTP or WebRTC session drops correlated with inbound packets shorter than 12 bytes on the RTP/ICE port.
STUN packets with XOR-MAPPED-ADDRESS or MAPPED-ADDRESS attribute lengths between 0 and 7 bytes.

Detection Strategies

Instrument SIPSorcery-based services to alert on UdpReceiver non-socket exceptions and correlated channel closures.
Inspect packet captures on RTP/ICE ports for undersized UDP payloads targeting active sessions.
Track version inventory of the SIPSorcery NuGet package across build pipelines to identify pre-10.0.9 deployments.

Monitoring Recommendations

Baseline expected packet sizes on RTP/ICE ports and alert on sustained anomalies of sub-12-byte payloads.
Monitor SIP and WebRTC session churn metrics for spikes coinciding with new remote source addresses.
Forward application logs from SIPSorcery services into a centralized analytics pipeline for exception correlation.

How to Mitigate CVE-2026-54632

Immediate Actions Required

Upgrade the SIPSorcery NuGet package to version 10.0.9 or later across all affected services.
Restart affected media services after upgrade to ensure the patched receive loop is active.
Audit exposed RTP/ICE port ranges and restrict source reachability where feasible.

Patch Information

The fix is delivered in SIPSorcery 10.0.9 via commit bdb76cb and pull request #1677. The patch enforces a minimum packet length of RTPHeader.MIN_HEADER_LEN in OnRTPPacketReceived, adds length validation to the STUN attribute parsers, and changes UdpReceiver.EndReceiveFrom to log and continue on non-socket exceptions instead of calling Close. Full details are in GHSA-28gm-jrmw-xx93.

Workarounds

Restrict RTP/ICE port ranges at the firewall to known peer address ranges where the deployment topology allows it.
Rotate ephemeral RTP/ICE ports frequently to reduce the window during which an attacker can target a session.
Front-end WebRTC services with a media relay or TURN server that validates packet structure before forwarding.

bash

# Update the SIPSorcery package to the patched release
dotnet add package SIPSorcery --version 10.0.9
dotnet restore
dotnet build --configuration Release