CVE-2026-45809
Received Received - Intake

Denial of Service in OpenSIPS via Watcherinfo Generation

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-45809

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensips opensips to 4.0.0|end_including=3.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in OpenSIPS, a SIP server implementation. It affects versions before 3.6.6 and 4.0.0-rc1. An attacker sends a crafted SUBSCRIBE request with a long From URI to create an oversized watcher entry. Then, they request watcherinfo XML generation for the same presentity, causing a stack buffer overflow in the presence module. This crashes the OpenSIPS worker process.

Detection Guidance

To detect this vulnerability, monitor OpenSIPS logs for crashes or errors in the presence module. Check for SUBSCRIBE requests with long From URIs (over 199 characters) targeting presence.winfo. Use network traffic analysis tools like tcpdump or Wireshark to inspect SIP traffic for unusually long URIs in SUBSCRIBE Event: presence requests.

Impact Analysis

If exploited, this vulnerability can crash OpenSIPS worker processes, leading to service disruption. The attack requires network access and no privileges or user interaction. It can cause downtime for SIP-based services relying on OpenSIPS, especially if presence and presence_xml modules are loaded and watcherinfo generation is enabled.

Mitigation Strategies

Immediately upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later. If upgrading is not possible, restrict access to the presence and presence_xml modules by modifying routing rules to block SUBSCRIBE requests with long URIs. Disable the presence.winfo functionality if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart