CVE-2026-77322

HighCVSS 7.5

Published: 22/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

42th percentile - higher than 42% of all known CVEs

Summary

SIPGO prior to 1.4.3 contains a vulnerability in WSConnection.Read that does not set MaxFrameSize, allowing an unauthenticated WS or WSS peer to send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic and crashing or exhausting memory in the server process.

Risk Assessment

An attacker could cause a server crash or memory exhaustion, leading to denial of service.

Recommendation

Upgrade SIPGO to version 1.4.3 or later.

Other vulnerabilities in SIPGO

CVE-2026-58268High
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

Original NVD description (English source)

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS