CVE-2026-45538

Received Received - Intake

Stack Buffer Overflow in OpenSIPS via sip_to_json()

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-45538

Affected Vendors & Products

Vendor	Product	Version / Range
opensips	opensips	to 4.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack buffer overflow in OpenSIPS versions 4.0.0 and prior. It occurs when a SIP message contains a header name longer than 255 bytes. The function sip_to_json() copies the header name into a fixed 255-byte stack buffer without checking the length, causing a buffer overflow. Attackers can exploit this by sending a specially crafted SIP message to crash the process or execute arbitrary code.

Detection Guidance

Detecting this vulnerability requires monitoring for SIP messages with header names longer than 255 bytes. Inspect SIP traffic on port 5060/udp for unusually long header names. Use tools like tcpdump or Wireshark to capture and analyze SIP packets. Check OpenSIPS logs for crashes or errors related to sip_to_json() or buffer overflows.

Impact Analysis

This vulnerability allows unauthenticated attackers to remotely crash OpenSIPS or execute arbitrary code by sending a single UDP packet to the SIP port (5060). If successful, it could lead to service disruption, unauthorized access, or complete system compromise, depending on the OpenSIPS deployment and environment.

Mitigation Strategies

Upgrade OpenSIPS to a version where this issue is fixed. If no patch is available, restrict access to the SIP port (5060/udp) using firewalls. Disable or modify routing scripts that call sip_to_json() to avoid processing malformed headers. Monitor for exploit attempts and apply network-level protections.

Hi! I’m here to help you understand CVE-2026-45538. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70