stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

Linux Distros Unpatched Vulnerability : CVE-2026-122126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader, which TurnTlsSocket inherits, that allows malicious...

CVE-2026-116790

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-116790

In versions prior to 1.11.2 , FreeSWITCH fails to cryptographically validate the STUN MESSAGE-INTEGRITY attribute during inbound ICE connectivity checks . An attacker capable of reaching an ICE-enabled leg's media port can forge these checks without SDP credentials. This allows the attacker to no...

CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-122126

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader, which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declari...

CVE-2026-122126 reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader, which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declari...

EUVD-2026-117081

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the...

PT-2026-137149

reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader that allows malicious TURN servers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the...

CLEANSTART-2024-SB49093 When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash

CVE-2020-12420 affects multiple packages. When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. See references for individual vulnerability details...

CLEANSTART-2024-AC39888 When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash

CVE-2020-12420 affects multiple packages. When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. See references for individual vulnerability details...

Uncaught Exception

Overview @libp2p/webrtc is an A libp2p transport using WebRTC connections Affected versions of this package are vulnerable to Uncaught Exception via the STUN listener in stun-listener.ts, where an unvalidated ufrag value from an incoming STUN request is passed directly into the native ICE stack a...

CVE-2026-103936

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936

The libp2p JavaScript networking stack is vulnerable in versions prior to 6.0.28 due to improper handling of unauthenticated STUN Binding Requests within the @libp2p/webrtc Node.js listener. The stun-listener.ts component forwards the request.ufrag value into DirectRTCPeerConnection.setLocalDescr...