CVE-2026-45538
CriticalCVSS 9.8Summary
OpenSIPS version 4.0.0 and prior contain a stack buffer overflow in sip_to_json() when a SIP header name exceeds 255 bytes. An attacker can send a single UDP packet to port 5060 to crash the process or potentially achieve remote code execution.
Risk Assessment
Risk of SIP server crash or remote code execution in environments where the routing script calls sip_to_json().
Recommendation
Check for an available patch for OpenSIPS. If not, avoid calling sip_to_json() on untrusted data or limit header name lengths.
Original NVD description (English source)
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.