GHSA-jwjp-4649-v8jp: Out-of-Bounds Read in SIPSorcery SCTP SACK Chunk Parsing

Vulnerability ID: GHSA-JWJP-4649-V8JP
CVSS Score: 7.5
Published: 2026-08-12

An out-of-bounds read vulnerability in the SCTP SACK chunk parser of SIPSorcery leads to Denial of Service (DoS) or silent internal state corruption due to lack of boundary validation on incoming chunk elements.

TL;DR

Unchecked Gap Ack Block and Duplicate TSN counts in SIPSorcery SCTP SACK chunk parsing permit out-of-bounds reads, crashing the receive thread and causing a denial of service.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-125 / CWE-248
Attack Vector: Network
CVSS v3.1 Score: 7.5 (High)
Impact: Denial of Service (DoS) / State Corruption
Exploit Status: Proof-of-Concept
Affected Component: SctpSackChunk.ParseChunk

Affected Systems

SIPSorcery C# .NET WebRTC Library
SIPSorcery: < commit a2466550bb2a28821c73fb1961bc33dcc467f8cf (Fixed in: commit a2466550bb2a28821c73fb1961bc33dcc467f8cf)

Code Analysis

Commit: a246655

Fix SCTP out-of-bounds reads in SACK chunk parsing by validating required length against declared length and catching exception types.

Mitigation Strategies

Upgrade SIPSorcery dependency to a patched version containing PR #1772.
Implement network-level packet validation for SCTP packets.
Configure active health checks for WebRTC Data Channels to automatically restart stalled transport instances.

Remediation Steps:

Identify all C# projects using the SIPSorcery NuGet package.
Update the package reference in .csproj to the latest stable version or a version including commit a2466550bb2a28821c73fb1961bc33dcc467f8cf.
Rebuild the application and deploy the updated binaries.
Verify that SCTP SACK chunk parsing tests pass in the build environment.