CVE-2026-45103
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. An attacker can send a Content-Length value that overflows (e.g., 4294967296), causing the framing layer to compute a wrapped-around value and split the TCP stream at the wrong boundary, enabling SIP message smuggling. Because Content-Length is parsed before authentication, an unauthenticated attacker can smuggle arbitrary SIP messages over any TCP-based transport.
Risk Assessment
Smuggled SIP messages can bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting, potentially leading to unauthorized operations and session integrity compromise.
Recommendation
Immediately upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1, which contain the fix. If upgrade is not possible, restrict access to the SIP server from trusted networks.
Other vulnerabilities in OpenSIPS
See all- CVE-2026-45537Critical
OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1 contains a buffer overflow in the construct_uri() function, which concatenates URI components into a fixed 1024-byte buffer without bounds checking. An attacker can control the username to overflow the buffer and overwrite adjacent global data, including the disable_503_translation flag, altering routing behavior.
- CVE-2026-45100Critical
OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check does not account for base64 expansion, allowing overflow of up to 21,844 bytes, overwriting adjacent transformation buffers.
- CVE-2026-45538Critical
OpenSIPS version 4.0.0 and prior contain a stack buffer overflow in sip_to_json() when a SIP header name exceeds 255 bytes. An attacker can send a single UDP packet to port 5060 to crash the process or potentially achieve remote code execution.
- CVE-2026-46334High
OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A malformed SDP bandwidth line can corrupt parsed metadata, leading to a crash of the OpenSIPS worker process.
- CVE-2026-45809High
OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. A SUBSCRIBE request with a long From URI can cause a stack buffer overflow and crash the process.
- CVE-2026-45705Medium
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
- CVE-2026-45084High
In OpenSIPS versions 3.4.0 through 3.6.5, there is a denial of service vulnerability in the presence module. The handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while enable_sphere_check=1, invoking get_content_type() without first calling parse_content_type_hdr(), causing a crash due to dereferencing uninitialized or NULL Content-Type parsing state. A remote attacker can cause a denial of service with a single PUBLISH request over UDP or TCP.
- CVE-2026-25554Medium
The auth_jwt module in OpenSIPS versions 3.1 before 3.6.4 contains a SQL injection vulnerability in the jwt_db_authorize() function. An attacker can send a crafted JWT with a malicious tag claim that is directly incorporated into a SQL query without sanitization, allowing bypass of JWT authentication and impersonation of arbitrary identities.
Original NVD description (English source)
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.