CVE-2026-45084

Received Received - Intake

Denial of Service in OpenSIPS Presence Module

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-45084

Affected Vendors & Products

Vendor	Product	Version / Range
opensips	opensips	From 3.4.0 (inc) to 3.6.5 (inc)
opensips	opensips	3.6.6
opensips	opensips	4.0.0-rc1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

OpenSIPS versions 3.4.0 through 3.6.5 have a denial of service vulnerability in the presence module. When processing a SIP PUBLISH request with an Event: presence header and a message body while enable_sphere_check=1 is set, the handle_publish() function crashes due to dereferencing uninitialized or NULL Content-Type parsing state in get_content_type(). This happens if the Content-Type header is missing or unparsed, leading to a NULL pointer dereference.

Detection Guidance

Detect this vulnerability by checking OpenSIPS versions between 3.4.0 and 3.6.5. Look for crashes in the presence module when processing SIP PUBLISH requests with an Event: presence header and message body. Monitor logs for segmentation faults or NULL pointer dereferences in the presence module.

Impact Analysis

A remote attacker can exploit this vulnerability by sending a single malicious PUBLISH request over UDP or TCP to crash the OpenSIPS server. This causes a denial of service, making the server unavailable for legitimate users. The attack does not require authentication but may depend on routing configuration.

Compliance Impact

This vulnerability causes a denial of service (DoS) in OpenSIPS, which could disrupt critical communication services. For compliance with standards like GDPR or HIPAA, which require availability of systems processing personal or sensitive data, such disruptions may violate availability requirements. The DoS could lead to unauthorized downtime, potentially impacting data access or processing.

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 immediately. If upgrading is not possible, disable the presence module or set enable_sphere_check=0 in the configuration. Block or filter SIP PUBLISH requests with Event: presence headers at the network perimeter.

Hi! I’m here to help you understand CVE-2026-45084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70