Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
42 vulnerabilities by opensips
CVE-2026-46334 (GCVE-0-2026-46334)
Vulnerability from nvd – Published: 2026-08-04 23:50 – Updated: 2026-08-05 14:28
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/8fe74… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/ac530… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46334",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:20:44.265583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:28:03.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:50:57.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/8fe74b01f6fbf86c0b5e290735275530cb65e0fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/8fe74b01f6fbf86c0b5e290735275530cb65e0fb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444"
}
],
"source": {
"advisory": "GHSA-rh36-mhpv-cx2r",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46334",
"datePublished": "2026-08-04T23:50:57.147Z",
"dateReserved": "2026-05-13T18:37:30.989Z",
"dateUpdated": "2026-08-05T14:28:03.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45809 (GCVE-0-2026-45809)
Vulnerability from nvd – Published: 2026-08-04 23:30 – Updated: 2026-08-05 13:57
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/c5970… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/dd864… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45809",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:57:30.647530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:57:39.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:30:03.111Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d"
}
],
"source": {
"advisory": "GHSA-gx83-2gh8-7v56",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45809",
"datePublished": "2026-08-04T23:30:03.111Z",
"dateReserved": "2026-05-13T08:19:32.604Z",
"dateUpdated": "2026-08-05T13:57:39.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45705 (GCVE-0-2026-45705)
Vulnerability from nvd – Published: 2026-08-04 23:16 – Updated: 2026-08-05 13:39
VLAI
EPSS
VEX
Title
OpenSIPS: OOB Read in Multipart Body Boundary Parsing
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45705",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:39:14.301461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:39:43.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body\u0027s end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:16:31.543Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-chxf-9368-fqcp",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: OOB Read in Multipart Body Boundary Parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45705",
"datePublished": "2026-08-04T23:16:31.543Z",
"dateReserved": "2026-05-13T04:38:01.165Z",
"dateUpdated": "2026-08-05T13:39:43.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45537 (GCVE-0-2026-45537)
Vulnerability from nvd – Published: 2026-08-04 22:48 – Updated: 2026-08-05 17:48
VLAI
EPSS
VEX
Title
OpenSIPS: Global Buffer Overflow in construct_uri
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45537",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:47:59.631408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:48:44.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server\u0027s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function\u0027s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T22:48:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-v7h4-fwrc-c66v",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Global Buffer Overflow in construct_uri"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45537",
"datePublished": "2026-08-04T22:48:43.580Z",
"dateReserved": "2026-05-12T17:48:47.878Z",
"dateUpdated": "2026-08-05T17:48:44.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45103 (GCVE-0-2026-45103)
Vulnerability from nvd – Published: 2026-08-04 21:56 – Updated: 2026-08-05 17:55
VLAI
EPSS
VEX
Title
OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d23613b | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103eff | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:53:22.085357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:55:45.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection\u0027s authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:56:57.422Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103eff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103eff"
}
],
"source": {
"advisory": "GHSA-jv35-555v-54jh",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45103",
"datePublished": "2026-08-04T21:56:57.422Z",
"dateReserved": "2026-05-08T19:27:26.699Z",
"dateUpdated": "2026-08-05T17:55:45.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45100 (GCVE-0-2026-45100)
Vulnerability from nvd – Published: 2026-08-04 21:41 – Updated: 2026-08-05 14:01
VLAI
EPSS
VEX
Title
OpenSIPS: Buffer Overflow in Base64 Encode Transformation
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45100",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:01:31.757517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:01:56.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0-beta, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode}\u00a0string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies \u00a0{s.b64encode}\u00a0 to attacker-controlled input, making exploitability dependent on the deployment\u0027s routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:44:40.109Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-35fr-6rv9-vp68",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Buffer Overflow in Base64 Encode Transformation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45100",
"datePublished": "2026-08-04T21:41:54.584Z",
"dateReserved": "2026-05-08T19:27:26.698Z",
"dateUpdated": "2026-08-05T14:01:56.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45084 (GCVE-0-2026-45084)
Vulnerability from nvd – Published: 2026-08-04 21:23 – Updated: 2026-08-05 14:16
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:15:36.858995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:16:11.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module\u0027s handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg-\u003econtent_type-\u003eparsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg-\u003econtent_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment\u0027s routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:23:21.106Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9"
}
],
"source": {
"advisory": "GHSA-h3ww-hchh-x2g9",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45084",
"datePublished": "2026-08-04T21:23:21.106Z",
"dateReserved": "2026-05-08T18:45:10.097Z",
"dateUpdated": "2026-08-05T14:16:11.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45538 (GCVE-0-2026-45538)
Vulnerability from nvd – Published: 2026-08-04 20:47 – Updated: 2026-08-05 14:28
VLAI
EPSS
VEX
Title
OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:56:32.620733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:28:49.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:47:10.262Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3"
}
],
"source": {
"advisory": "GHSA-37wc-5j8j-95x3",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45538",
"datePublished": "2026-08-04T20:47:10.262Z",
"dateReserved": "2026-05-12T17:48:47.878Z",
"dateUpdated": "2026-08-05T14:28:49.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25554 (GCVE-0-2026-25554)
Vulnerability from nvd – Published: 2026-02-25 16:54 – Updated: 2026-07-14 15:53
VLAI
EPSS
VEX
Title
OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass
Summary
OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://opensips.org/pub/opensips/3.6.4/ChangeLog | release-notes |
| https://github.com/OpenSIPS/opensips/pull/3807 | issue-tracking |
| https://github.com/OpenSIPS/opensips/commit/3822d… | patch |
| https://opensips.org/ | product |
| https://www.vulncheck.com/advisories/opensips-aut… | third-party-advisory |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T16:43:08.070958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T16:43:16.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/OpenSIPS/opensips",
"product": "OpenSIPS",
"repo": "https://github.com/OpenSIPS/opensips",
"vendor": "OpenSIPS",
"versions": [
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.6.4",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pavel Kohout, Aisle Research, www.aisle.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities."
}
],
"value": "OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:53:41.151Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://opensips.org/pub/opensips/3.6.4/ChangeLog"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenSIPS/opensips/pull/3807"
},
{
"tags": [
"patch"
],
"url": "https://github.com/OpenSIPS/opensips/commit/3822d33c1c6b25832fdd88da1d23eed74be55b05"
},
{
"tags": [
"product"
],
"url": "https://opensips.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opensips-auth-jwt-sql-injection-enables-jwt-authentication-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OpenSIPS 3.1 \u003c= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-25554",
"datePublished": "2026-02-25T16:54:11.845Z",
"dateReserved": "2026-02-02T20:12:33.395Z",
"dateUpdated": "2026-07-14T15:53:41.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-28099 (GCVE-0-2023-28099)
Vulnerability from nvd – Published: 2023-03-15 22:16 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the ds_is_in_list() function
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/issues/2780 | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/e2f13d374 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3"
},
{
"name": "https://github.com/OpenSIPS/opensips/issues/2780",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/issues/2780"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/e2f13d374",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/e2f13d374"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:32.495012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:03.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:16:57.958Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3"
},
{
"name": "https://github.com/OpenSIPS/opensips/issues/2780",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/issues/2780"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/e2f13d374",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/e2f13d374"
}
],
"source": {
"advisory": "GHSA-pfm5-6vhv-3ff3",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the ds_is_in_list() function"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28099",
"datePublished": "2023-03-15T22:16:57.958Z",
"dateReserved": "2023-03-10T18:34:29.226Z",
"dateUpdated": "2025-02-25T14:56:03.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28098 (GCVE-0-2023-28098)
Vulnerability from nvd – Published: 2023-03-15 22:11 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the Digest Authentication Parser
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing
functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/dd914… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:35.970124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:10.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing\nfunctions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:11:01.323Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-jrqg-vppj-hr2h",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the Digest Authentication Parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28098",
"datePublished": "2023-03-15T22:11:01.323Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:10.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28097 (GCVE-0-2023-28097)
Vulnerability from nvd – Published: 2023-03-15 22:03 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the Content-Length Parser
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/7cab4… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:41.433847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:16.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:03:41.362Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-c6j5-f4h4-2xrq",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the Content-Length Parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28097",
"datePublished": "2023-03-15T22:03:41.362Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:16.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28096 (GCVE-0-2023-28096)
Vulnerability from nvd – Published: 2023-03-15 21:52 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has memory leak in cJSON lib
Summary
OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.
To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.
The issue has been fixed in versions 3.1.8 and 3.2.5.
Severity
4.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/41756… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:39.580143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:23.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.0, \u003c 3.1.8"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{\"jsonrpc\": \"2.0\",\"method\": \"log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.\n\nTo abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system\u2019s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.\n\nThe issue has been fixed in versions 3.1.8 and 3.2.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:52:00.194Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-2mg2-g46r-j4qr",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has memory leak in cJSON lib"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28096",
"datePublished": "2023-03-15T21:52:00.194Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:23.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28095 (GCVE-0-2023-28095)
Vulnerability from nvd – Published: 2023-03-15 21:43 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the building the local negative replies
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/9cf3d… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.089Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:44.054305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:28.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:43:10.408Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-7pf3-24qg-8v9h",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the building the local negative replies"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28095",
"datePublished": "2023-03-15T21:43:10.408Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:28.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27601 (GCVE-0-2023-27601)
Vulnerability from nvd – Published: 2023-03-15 21:32 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the codec_delete_XX() functions
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).
The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`):
By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/8f87c… | x_refsource_MISC |
| https://opensips.org/docs/modules/3.3.x/sipmsgops.html | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:16:36.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf"
},
{
"name": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:47.061221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:36.328Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`):\n\nBy abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:32:56.061Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf"
},
{
"name": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-xj5x-g52f-548h",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the codec_delete_XX() functions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-27601",
"datePublished": "2023-03-15T21:32:56.061Z",
"dateReserved": "2023-03-04T01:03:53.637Z",
"dateUpdated": "2025-02-25T14:56:36.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27600 (GCVE-0-2023-27600)
Vulnerability from nvd – Published: 2023-03-15 21:14 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the codec_delete_XX() functions
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).
The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`).
By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/c6ab3… | x_refsource_MISC |
| https://opensips.org/docs/modules/3.3.x/sipmsgops.html | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:16:36.198Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100"
},
{
"name": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:49.802058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:44.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`).\n\nBy abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:14:33.131Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100"
},
{
"name": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-67w7-g4j8-3wcx",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the codec_delete_XX() functions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-27600",
"datePublished": "2023-03-15T21:14:33.131Z",
"dateReserved": "2023-03-04T01:03:53.637Z",
"dateUpdated": "2025-02-25T14:56:44.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-46334 (GCVE-0-2026-46334)
Vulnerability from cvelistv5 – Published: 2026-08-04 23:50 – Updated: 2026-08-05 14:28
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/8fe74… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/ac530… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46334",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:20:44.265583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:28:03.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:50:57.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/8fe74b01f6fbf86c0b5e290735275530cb65e0fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/8fe74b01f6fbf86c0b5e290735275530cb65e0fb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444"
}
],
"source": {
"advisory": "GHSA-rh36-mhpv-cx2r",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46334",
"datePublished": "2026-08-04T23:50:57.147Z",
"dateReserved": "2026-05-13T18:37:30.989Z",
"dateUpdated": "2026-08-05T14:28:03.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45809 (GCVE-0-2026-45809)
Vulnerability from cvelistv5 – Published: 2026-08-04 23:30 – Updated: 2026-08-05 13:57
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/c5970… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/dd864… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45809",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:57:30.647530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:57:39.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:30:03.111Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d"
}
],
"source": {
"advisory": "GHSA-gx83-2gh8-7v56",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45809",
"datePublished": "2026-08-04T23:30:03.111Z",
"dateReserved": "2026-05-13T08:19:32.604Z",
"dateUpdated": "2026-08-05T13:57:39.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45705 (GCVE-0-2026-45705)
Vulnerability from cvelistv5 – Published: 2026-08-04 23:16 – Updated: 2026-08-05 13:39
VLAI
EPSS
VEX
Title
OpenSIPS: OOB Read in Multipart Body Boundary Parsing
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45705",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:39:14.301461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:39:43.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body\u0027s end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T23:16:31.543Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-chxf-9368-fqcp",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: OOB Read in Multipart Body Boundary Parsing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45705",
"datePublished": "2026-08-04T23:16:31.543Z",
"dateReserved": "2026-05-13T04:38:01.165Z",
"dateUpdated": "2026-08-05T13:39:43.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45537 (GCVE-0-2026-45537)
Vulnerability from cvelistv5 – Published: 2026-08-04 22:48 – Updated: 2026-08-05 17:48
VLAI
EPSS
VEX
Title
OpenSIPS: Global Buffer Overflow in construct_uri
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45537",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:47:59.631408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:48:44.922Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server\u0027s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function\u0027s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T22:48:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-v7h4-fwrc-c66v",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Global Buffer Overflow in construct_uri"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45537",
"datePublished": "2026-08-04T22:48:43.580Z",
"dateReserved": "2026-05-12T17:48:47.878Z",
"dateUpdated": "2026-08-05T17:48:44.922Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45103 (GCVE-0-2026-45103)
Vulnerability from cvelistv5 – Published: 2026-08-04 21:56 – Updated: 2026-08-05 17:55
VLAI
EPSS
VEX
Title
OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d23613b | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103eff | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45103",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:53:22.085357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:55:45.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection\u0027s authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:56:57.422Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103eff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103eff"
}
],
"source": {
"advisory": "GHSA-jv35-555v-54jh",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45103",
"datePublished": "2026-08-04T21:56:57.422Z",
"dateReserved": "2026-05-08T19:27:26.699Z",
"dateUpdated": "2026-08-05T17:55:45.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45100 (GCVE-0-2026-45100)
Vulnerability from cvelistv5 – Published: 2026-08-04 21:41 – Updated: 2026-08-05 14:01
VLAI
EPSS
VEX
Title
OpenSIPS: Buffer Overflow in Base64 Encode Transformation
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/4d236… | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/5f103… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45100",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:01:31.757517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:01:56.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0-beta, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode}\u00a0string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies \u00a0{s.b64encode}\u00a0 to attacker-controlled input, making exploitability dependent on the deployment\u0027s routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:44:40.109Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
}
],
"source": {
"advisory": "GHSA-35fr-6rv9-vp68",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Buffer Overflow in Base64 Encode Transformation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45100",
"datePublished": "2026-08-04T21:41:54.584Z",
"dateReserved": "2026-05-08T19:27:26.698Z",
"dateUpdated": "2026-08-05T14:01:56.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45084 (GCVE-0-2026-45084)
Vulnerability from cvelistv5 – Published: 2026-08-04 21:23 – Updated: 2026-08-05 14:16
VLAI
EPSS
VEX
Title
OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:15:36.858995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:16:11.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.4.0, \u003c 3.6.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module\u0027s handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg-\u003econtent_type-\u003eparsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg-\u003econtent_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment\u0027s routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:23:21.106Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9"
}
],
"source": {
"advisory": "GHSA-h3ww-hchh-x2g9",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45084",
"datePublished": "2026-08-04T21:23:21.106Z",
"dateReserved": "2026-05-08T18:45:10.097Z",
"dateUpdated": "2026-08-05T14:16:11.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45538 (GCVE-0-2026-45538)
Vulnerability from cvelistv5 – Published: 2026-08-04 20:47 – Updated: 2026-08-05 14:28
VLAI
EPSS
VEX
Title
OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:56:32.620733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:28:49.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:47:10.262Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3"
}
],
"source": {
"advisory": "GHSA-37wc-5j8j-95x3",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45538",
"datePublished": "2026-08-04T20:47:10.262Z",
"dateReserved": "2026-05-12T17:48:47.878Z",
"dateUpdated": "2026-08-05T14:28:49.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25554 (GCVE-0-2026-25554)
Vulnerability from cvelistv5 – Published: 2026-02-25 16:54 – Updated: 2026-07-14 15:53
VLAI
EPSS
VEX
Title
OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass
Summary
OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://opensips.org/pub/opensips/3.6.4/ChangeLog | release-notes |
| https://github.com/OpenSIPS/opensips/pull/3807 | issue-tracking |
| https://github.com/OpenSIPS/opensips/commit/3822d… | patch |
| https://opensips.org/ | product |
| https://www.vulncheck.com/advisories/opensips-aut… | third-party-advisory |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T16:43:08.070958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T16:43:16.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/OpenSIPS/opensips",
"product": "OpenSIPS",
"repo": "https://github.com/OpenSIPS/opensips",
"vendor": "OpenSIPS",
"versions": [
{
"lessThan": "3.6.4",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.6.4",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pavel Kohout, Aisle Research, www.aisle.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities."
}
],
"value": "OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T15:53:41.151Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://opensips.org/pub/opensips/3.6.4/ChangeLog"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenSIPS/opensips/pull/3807"
},
{
"tags": [
"patch"
],
"url": "https://github.com/OpenSIPS/opensips/commit/3822d33c1c6b25832fdd88da1d23eed74be55b05"
},
{
"tags": [
"product"
],
"url": "https://opensips.org/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opensips-auth-jwt-sql-injection-enables-jwt-authentication-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "OpenSIPS 3.1 \u003c= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-25554",
"datePublished": "2026-02-25T16:54:11.845Z",
"dateReserved": "2026-02-02T20:12:33.395Z",
"dateUpdated": "2026-07-14T15:53:41.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-28099 (GCVE-0-2023-28099)
Vulnerability from cvelistv5 – Published: 2023-03-15 22:16 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the ds_is_in_list() function
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/issues/2780 | x_refsource_MISC |
| https://github.com/OpenSIPS/opensips/commit/e2f13d374 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3"
},
{
"name": "https://github.com/OpenSIPS/opensips/issues/2780",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/issues/2780"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/e2f13d374",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/e2f13d374"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:32.495012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:03.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:16:57.958Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3"
},
{
"name": "https://github.com/OpenSIPS/opensips/issues/2780",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/issues/2780"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/e2f13d374",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/e2f13d374"
}
],
"source": {
"advisory": "GHSA-pfm5-6vhv-3ff3",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the ds_is_in_list() function"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28099",
"datePublished": "2023-03-15T22:16:57.958Z",
"dateReserved": "2023-03-10T18:34:29.226Z",
"dateUpdated": "2025-02-25T14:56:03.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28098 (GCVE-0-2023-28098)
Vulnerability from cvelistv5 – Published: 2023-03-15 22:11 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the Digest Authentication Parser
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing
functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/dd914… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:35.970124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:10.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing\nfunctions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:11:01.323Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-jrqg-vppj-hr2h",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the Digest Authentication Parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28098",
"datePublished": "2023-03-15T22:11:01.323Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:10.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28097 (GCVE-0-2023-28097)
Vulnerability from cvelistv5 – Published: 2023-03-15 22:03 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the Content-Length Parser
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/7cab4… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:41.433847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:16.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.9"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T22:03:41.362Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-c6j5-f4h4-2xrq",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the Content-Length Parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28097",
"datePublished": "2023-03-15T22:03:41.362Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:16.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28096 (GCVE-0-2023-28096)
Vulnerability from cvelistv5 – Published: 2023-03-15 21:52 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has memory leak in cJSON lib
Summary
OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.
To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.
The issue has been fixed in versions 3.1.8 and 3.2.5.
Severity
4.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/41756… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:29:39.580143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:23.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.3.0, \u003c 3.1.8"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{\"jsonrpc\": \"2.0\",\"method\": \"log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.\n\nTo abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system\u2019s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.\n\nThe issue has been fixed in versions 3.1.8 and 3.2.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:52:00.194Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-2mg2-g46r-j4qr",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has memory leak in cJSON lib"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28096",
"datePublished": "2023-03-15T21:52:00.194Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:23.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28095 (GCVE-0-2023-28095)
Vulnerability from cvelistv5 – Published: 2023-03-15 21:43 – Updated: 2025-02-25 14:56
VLAI
EPSS
VEX
Title
OpenSIPS has vulnerability in the building the local negative replies
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenSIPS/opensips/security/adv… | x_refsource_CONFIRM |
| https://github.com/OpenSIPS/opensips/commit/9cf3d… | x_refsource_MISC |
| https://opensips.org/pub/audit-2022/opensips-audi… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:30:24.089Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-25T14:30:44.054305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-25T14:56:28.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "opensips",
"vendor": "OpenSIPS",
"versions": [
{
"status": "affected",
"version": "\u003c 3.1.7"
},
{
"status": "affected",
"version": "\u003e= 3.2.0, \u003c 3.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-15T21:43:10.408Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h"
},
{
"name": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c"
},
{
"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
"tags": [
"x_refsource_MISC"
],
"url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"
}
],
"source": {
"advisory": "GHSA-7pf3-24qg-8v9h",
"discovery": "UNKNOWN"
},
"title": "OpenSIPS has vulnerability in the building the local negative replies"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-28095",
"datePublished": "2023-03-15T21:43:10.408Z",
"dateReserved": "2023-03-10T18:34:29.225Z",
"dateUpdated": "2025-02-25T14:56:28.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}