AIKIDO-2026-429832

TL;DR

The TURN server's UDP receive loop in TurnServer places its catch-all exception handler outside the while loop and launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in the 0x80 to 0xFF range makes STUNHeader.ParseSTUNHeader throw an uncaught exception that unwinds past the loop and terminates it. Because nothing re-invokes the receiver, the TURN UDP relay becomes unavailable for every client until the host process is restarted. The fix wraps per-datagram handling in a try/log-and-continue block inside the loop and adds receiver supervision.