CVE-2026-46334
Received Received - Intake

Denial of Service in OpenSIPS via Malformed SDP Bandwidth Line

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-46334

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
opensips opensips to 4.0.0-rc1 (exc)
opensips opensips 3.6.6
opensips opensips 4.0.0-rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in OpenSIPS, a SIP server implementation. It affects versions before 3.6.6 and 4.0.0-rc1. The problem occurs when parsing SDP bandwidth lines that are malformed, specifically missing the required colon delimiter. This causes corruption in the parsed SDP bandwidth metadata, leading to crashes when dialog or QoS modules clone the corrupted state.

Detection Guidance

Monitor OpenSIPS logs for SDP parsing errors or crashes. Check for malformed bandwidth lines in SIP messages with Content-Type: application/sdp. Use network sniffing tools like tcpdump or Wireshark to inspect SIP traffic for SDP payloads missing the colon delimiter in bandwidth lines.

Impact Analysis

An unauthenticated remote attacker can exploit this by sending a SIP request with a malformed SDP payload. If your OpenSIPS server parses attacker-controlled SDP and uses dialog or QoS processing, the worker process will crash. This results in service disruption for your SIP services.

Mitigation Strategies

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later. If upgrading is not possible, disable dialog and QoS modules or restrict access to SDP parsing features. Monitor for crashes or errors in OpenSIPS logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart