AIKIDO-2026-348947

TL;DR

The SCTP packet parser in rtcsctptransport.py walks the chunks of a received packet and advances its cursor by each chunk's declared length. A chunk whose declared length is zero (for example a zero-length DATA chunk) left the cursor unchanged, so the parsing loop never made forward progress and never terminated. A remote peer on an established data-channel association could send such a malformed SCTP packet to trap the receiver in an infinite loop and exhaust CPU. The fix requires a minimum packet size and rejects any chunk whose length is below the chunk header size or exceeds the remaining packet data.