AIKIDO-2026-400608
SIPSorcery is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
SIPSorceryTL;DR
IceTcpReceiver overrides the base receiver methods but retains a catch-all handler that calls Close() on any exception, re-introducing an anti-pattern previously removed from the base UdpReceiver. A single malformed packet on the ICE-over-TCP path causes a null dereference that unwinds into this handler and disconnects the socket with no re-arm. The ICE-over-TCP receive path for that session is then permanently terminated. The fix changes the overrides to log-and-drop and re-arm and null-guards the reassigned packet.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use ICE-over-TCP connectivity to a STUN/TURN server whose relayed data can include a malformed or zero-length payload.
Background info
SIPSorcery is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.0.13.
How to fix this
Upgrade the SIPSorcery library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant