HIGH 7.5 GitHub
CVE-2026-54632
SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
### Impact
A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet (and STUN attribute) bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception into a channel `Close` rather than dropping the packet. One small, unauthenticated packet therefore ends the media session.
This is reachable during ICE connectivity checks — before the DTLS handsh
Affected Products
- nuget/SIPSorcery <= 10.0.8
References
- https://github.com/advisories/GHSA-28gm-jrmw-xx93
- https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-28gm-jrmw-xx93
- https://github.com/sipsorcery-org/sipsorcery/pull/1677
- https://github.com/sipsorcery-org/sipsorcery/commit/bdb76cbc0c7216e3126f743fb78e8525af56ce
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-07-28 via GitHub. Affected: nuget/SIPSorcery <= 10.0.8.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.