CVE-2026-89478 sctp: drop a chunk if its transport was removed

In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...

WS-2026-0041

SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields, each up to 65535, directly from an attacker-controlled SCTP SACK chunk and loops that many times reading four bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the ParseChunk function. An attacker can cause the termination of the SCTP receive thread and disrupt all data channels by sending a specially crafted SCTP SACK chunk with manipulated...

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

Summary SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields each up to 65535 directly from an attacker-controlled SCTP SACK chunk and loops that many times reading 4 bytes per iteration, with no validation of the counts against the chunk length or the receive buffer. A...

wireshark: DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33)

Integer overflow in the dissectsackchunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service infinite loop via a crafted Duplicate TSN count...

UBUNTU-CVE-2012-6056

Integer overflow in the dissectsackchunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service infinite loop via a crafted Duplicate TSN count...