{"metadata": {"vulnerability": "CVE-2026-58268", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-06-29T21:54:30.331Z", "date_only": false, "value": "2026-06-29T21:54:30.331Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-58268", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-22T19:49:09.625Z", "date_only": false, "value": "2026-09-22T19:49:09.625Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-58268", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-22T19:49:09.625Z", "date_only": false, "value": "2026-09-22T19:49:09.625Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-58268", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T19:57:51Z", "date_only": false, "value": "2026-09-22T19:57:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PG59-5VWG-4JXQ", "record": "GHSA-PG59-5VWG-4JXQ", "field": "published"}, {"timestamp": "2026-09-22T19:57:52Z", "date_only": false, "value": "2026-09-22T19:57:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PG59-5VWG-4JXQ", "record": "GHSA-PG59-5VWG-4JXQ", "field": "modified"}, {"timestamp": "2026-09-22T20:17:03.960Z", "date_only": false, "value": "2026-09-22T20:17:03.960", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58268", "record": "FKIE_CVE-2026-58268", "field": "published"}, {"timestamp": "2026-09-22T20:31:35.872Z", "date_only": false, "value": "2026-09-22T20:31:35.872004Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/0e253d405fcab64a2a0b8acc04c1d0c4", "record": "CVE-2026-58268", "field": "creation_timestamp", "uuid": "cc4fb04b-a774-47fa-b4b2-0d4746f7f865", "content": "# CVE-2026-58268: CVE-2026-58268: Denial of Service via Uncontrolled Memory Allocation in emiago/sipgo Stream Parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-58268\n\n## Summary\nA high-severity denial of service vulnerability exists in the emiago/sipgo Go library when parsing stream-based SIP messages. The stream parser fails to validate declared Content-Length header sizes before initiating memory allocations, allowing remote, unauthenticated attackers to trigger process memory exhaustion and application crashes.\n\n## TL;DR\nUnauthenticated remote attackers can crash sipgo-based services by transmitting a crafted SIP stream with an excessively large Content-Length header, causing the Go application to exhaust memory and terminate.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-789\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v1.4.1\n\n## Affected Systems\n\n- Applications utilizing emiago/sipgo prior to version 1.4.1\n- SIP gatekeepers, routers, and endpoints listening on TCP/TLS/WS/WSS transports using sipgo\n- **sipgo**: < 1.4.1 (Fixed in: `1.4.1`)\n\n## Mitigation\n\n- Upgrade library dependencies to version 1.4.1 or higher.\n- Enforce explicit limit configurations via MaxMessageLength.\n- Filter excessively large Content-Length values at the network boundary.\n\n**Remediation Steps:**\n1. Open a terminal in the root directory of your Go application.\n2. Execute the update command: go get github.com/emiago/sipgo@v1.4.1\n3. Clean up unnecessary module paths by executing: go mod tidy\n4. Rebuild and deploy the updated service binary.\n\n## References\n\n- [GitHub Security Advisory GHSA-pg59-5vwg-4jxq](https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq)\n- [Fix Commit a7be60a0](https://github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c)\n- [sipgo v1.4.1 Release Notes](https://github.com/emiago/sipgo/releases/tag/v1.4.1)\n- [CVE-2026-58268 Record](https://www.cve.org/CVERecord?id=CVE-2026-58268)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-58268) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/0e253d405fcab64a2a0b8acc04c1d0c4"}, {"timestamp": "2026-09-22T20:35:02.092Z", "date_only": false, "value": "2026-09-22T20:35:02.092017Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq", "record": "CVE-2026-58268", "field": "creation_timestamp", "uuid": "2eabdbf7-9ce7-42b7-b336-50c4d91dcf82", "url": "https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq"}, {"timestamp": "2026-09-23T12:38:22.446Z", "date_only": false, "value": "2026-09-23T12:38:22.446398Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58268", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-23T12:38:22.446Z", "date_only": false, "value": "2026-09-23T12:38:22.446398Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58268", "record": "FKIE_CVE-2026-58268", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T12:38:58.270Z", "date_only": false, "value": "2026-09-23T12:38:58.270Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-58268", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-23T12:38:58.270Z", "date_only": false, "value": "2026-09-23T12:38:58.270Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-58268", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T18:12:04.247Z", "date_only": false, "value": "2026-09-23T18:12:04.247", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-58268", "record": "FKIE_CVE-2026-58268", "field": "lastModified"}]}