stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

CVE-2026-103936

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

CVE-2026-103936

The libp2p JavaScript networking stack is vulnerable in versions prior to 6.0.28 due to improper handling of unauthenticated STUN Binding Requests within the @libp2p/webrtc Node.js listener. The stun-listener.ts component forwards the request.ufrag value into DirectRTCPeerConnection.setLocalDescr...

webrtc-ips

Richieste di indirizzi IP STUN per WebRTC Demo: https://diafygi.github.io/webrtc-ips/ Cosa fa Firefox e Chrome hanno implementato WebRTC, che consente di effettuare richieste a server STUN che restituiscono gli indirizzi IP locali e pubblici dell'utente. I risultati di queste richieste sono...

zeek-spicy-stun

STUN Session Traversal Utilities for NAT STUN Questo è un analizzatore di protocollo Zeek che rileva STUN basato su Spicy. Devi installare Spicy per usare questo pacchetto. Questo pacchetto creerà due log: stun.log - Questo log contiene ogni messaggio STUN. stunnat.log - Questo log contiene le...

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit SDK to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinar...

CLEANSTART-2023-MJ86716 Coturn is free open source implementation of TURN and STUN Server

Security vulnerability affects the coturn package. Coturn is free open source implementation of TURN and STUN Server...

CVE-2026-54632

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

EUVD-2026-78055

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

[SECURITY] Fedora 45 Update: baresip-4.11.0-1.fc45

A modular SIP user-agent with support for audio and video, and many IETF standards such as SIP, SDP, RTP/RTCP and STUN/TURN/ICE for both, IPv4 and IPv6. Additional modules provide support for audio codecs like Codec2, G.711, G.722, GSM, L16 and Opus, audio drivers like ALSA, GStreamer, JACK Audio...

SUSE CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

SUSE CVE-2026-40613

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8t to uint16t without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, thi...

WS-2026-0040

TurnServer.ReceiveUdpAsync places its generic catch Exception outside the while receive loop, and Start launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in the range 0x80 to 0xFF causes...

CVE-2026-68552

A flaw was found in Coturn. An unauthenticated remote client can send a specially crafted STUN message over TCP or TLS. This message, with a specific body-length field, causes an integer truncation overflow, leading to the desynchronization of the stream parser. Consequently, the attacking client...