CVE-2026-45103

Received Received - Intake

TCP Content-Length Overflow in OpenSIPS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-45103

Affected Vendors & Products

Vendor	Product	Version / Range
opensips	opensips	to 3.6.6 (exc)
opensips	opensips	to 4.0.0-rc1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenSIPS, a SIP server, in versions before 3.6.6 and 4.0.0-rc1. It involves improper parsing of the Content-Length header in TCP messages, where unsigned integer overflow causes incorrect message framing. Attackers can exploit this to split SIP messages at wrong boundaries, enabling SIP message smuggling.

Detection Guidance

Detecting this vulnerability requires monitoring SIP traffic for malformed Content-Length headers or unusual message splitting. Use tools like Wireshark to capture and analyze SIP over TCP traffic. Look for Content-Length values exceeding 4294967295 or messages with body content appearing as separate SIP messages without proper headers.

Impact Analysis

An unauthenticated attacker can smuggle arbitrary SIP messages over TCP-based transports (TCP, TLS, WebSocket, Secure WebSocket) if TCP is enabled. This allows bypassing front-end security policies, inheriting connection authentication, and evading rate limiting, potentially leading to unauthorized access or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Bypassing security controls may result in non-compliance with data protection and access control mandates.

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later immediately. Disable TCP-based transports (proto_tcp, proto_tls, proto_ws, proto_wss) if not required. Implement network-level controls to block malformed SIP traffic and monitor for suspicious message smuggling attempts.

Hi! I’m here to help you understand CVE-2026-45103. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70