SIPSorcery NuGet Package Vulnerable to Denial of Service Attack
- Severity
- HIGH
- Affected component
- sipsorcery (nuget)
- Affected versions
- <= 10.0.13
- Patched version
- Not yet available
The SIPSorcery NuGet package is reportedly vulnerable to a Denial of Service attack due to an out-of-bounds read in SCTP SACK chunk parsing. Users of affected versions should take immediate action.
What happened
The SIPSorcery NuGet package, specifically versions up to and including 10.0.13, appears to be vulnerable to a Denial of Service attack. This vulnerability arises from an out-of-bounds read during the parsing of SCTP SACK chunks. An attacker could exploit this by sending a specially crafted SACK chunk, causing the SCTP receive thread to terminate and resulting in a permanent denial of service.
This issue was first flagged on 2026-08-12T19:30:43+00:00 and is currently under investigation. There is no evidence that this vulnerability has been exploited in the wild. However, due to the severity of the potential impact, it is crucial for users to monitor for updates and apply patches as soon as they become available.
What to do about it
- Check your project dependencies for the SIPSorcery NuGet package and identify the version in use.
- If your project uses SIPSorcery version 10.0.13 or earlier, it is recommended to monitor the official sources for updates.
- Apply any patches or updates to the SIPSorcery package as soon as they are released.
- Consider implementing additional monitoring and logging to detect any unusual activity related to SCTP traffic.
How 0Day would have caught this
sipsorcery is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your project uses the SIPSorcery NuGet package version 10.0.13 or earlier, you may be affected by this vulnerability.
What should I do right now?
Monitor the official sources for updates and apply any patches or updates to the SIPSorcery package as soon as they are released.
Has an official fix been released?
No official fix has been published yet. Monitor the sources below for updates.
Where can I find more information?
Consult the primary sources provided for more detailed information and updates.