CVE-2026-45100

Received Received - Intake

Buffer Overflow in OpenSIPS via s.b64encode Transformation

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-45100

Affected Vendors & Products

Vendor	Product	Version / Range
opensips	opensips	From 3.4.0-beta (inc) to 3.6.5 (inc)
opensips	opensips	From 4.0.0-beta (inc) to 4.0.0-rc1 (inc)
opensips	opensips	3.6.6
opensips	opensips	4.0.0-rc1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta have a buffer overflow in the {s.b64encode} string transformation. The vulnerability occurs because base64 encoding expands input data by about a third, but the size check only ensures the input fits within a 64 KB buffer. An input of 49,153 to 65,535 bytes causes the output to exceed the buffer, overflowing by up to 21,844 bytes. This corrupts adjacent memory buffers used in chained transformations.

Detection Guidance

To detect this vulnerability, inspect OpenSIPS logs for SIP messages with headers exceeding 50,000 bytes that trigger the {s.b64encode} transformation. Check for crashes or memory corruption errors in OpenSIPS logs. Monitor network traffic for unusually large SIP headers.

Impact Analysis

A remote attacker could exploit this by sending a SIP message with a large header value (around 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input. This could lead to memory corruption, potentially allowing arbitrary code execution or denial of service. Exploitability depends on the deployment's routing configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data access or modification. A successful exploit may allow attackers to corrupt memory, leading to arbitrary code execution or data leakage. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding health information. Exploitation could violate these requirements if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later. If upgrading is not immediately possible, review routing scripts to avoid applying {s.b64encode} to untrusted or large input. Implement network-level filtering to block SIP messages with excessively large headers.

Hi! I’m here to help you understand CVE-2026-45100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70