Detections
Analytics
SCA: security update for SIPSorcery (GHSA-28gm-jrmw-xx93)
high Tenable Cloud Security Plugin ID 445398
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9,
RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and
STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while
UdpReceiver.EndReceiveFrom closes the channel when those operations raise a non-socket exception. A remote
party can send a single short RTP packet or malformed zero-to-seven-byte STUN address attribute to the
shared RTP/ICE socket, including during ICE connectivity checks before DTLS or STUN MESSAGE-INTEGRITY
verification, and terminate the active RTP or WebRTC media session. The attacker must reach or learn the
advertised ephemeral RTP/ICE port, but no authentication or user interaction is required, and the impact
is limited to availability. This issue is fixed in version 10.0.9. (CVE-2026-54632)
Solution
Update the SIPSorcery library and its related packages to version 10.0.9 or later.See Also
Plugin Details
Severity: High
ID: 445398
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 7/28/2026
Updated: 9/15/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-54632
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/28/2026
Vulnerability Publication Date: 7/28/2026
Reference Information
CVE: CVE-2026-54632