Out-of-Bounds Read in OpenSIPS SIP Server

Executive Summary

CVE-2026-45705 is an out-of-bounds read vulnerability in OpenSIPS, a SIP server implementation. It occurs in the multipart body parser function find_line_delimiter() when searching for MIME boundary delimiters. The function uses strncmp() to compare delimiters but may read past the end of the body buffer if a -- pattern appears near the end without the proper boundary delimiter. This causes it to access memory outside the intended buffer, potentially reading data from subsequent SIP messages in the receive buffer on TCP connections.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is not easily detectable via standard commands due to its nature as an out-of-bounds read that stays within the SIP receive buffer. It does not trigger AddressSanitizer (ASan) and may not leave obvious logs. Monitor for unusual SIP message parsing errors or crashes in OpenSIPS versions prior to 3.6.6 or 4.0.0-rc1.

Useful 0 Not Useful 0

Impact Analysis

The primary impact is low availability due to potential memory corruption. An attacker could exploit this to cause a denial of service by crashing the OpenSIPS server or reading sensitive data from memory. The vulnerability is network-accessible via SIP over UDP or TCP (port 5060) and does not require authentication to exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later immediately. These versions include fixes that enforce bounds checks in the multipart body parser and other components to prevent out-of-bounds reads.

Useful 0 Not Useful 0