CVE-2026-58268

Received Received - Intake

Memory Exhaustion in SIPGO SIP Parser

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-58268

EUVD

EUVD-2026-84817

Affected Vendors & Products

Vendor	Product	Version / Range
emiago	sipgo	to 1.4.1 (exc)
emiago	sipgo	1.4.1
sipgo	sipgo	1.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in the sipgo library (versions <= 1.4.0) allows an unauthenticated denial-of-service (DoS) attack. The parser allocates a SIP body buffer based on the Content-Length header value without validating its size first. An attacker can set an extremely large Content-Length value, causing excessive memory consumption and potentially crashing the service.

Detection Guidance

Monitor for excessive memory usage or crashes in services using sipgo versions <= 1.4.0 when processing SIP messages with large Content-Length headers. Check logs for messages indicating memory allocation failures or ErrMessageTooLarge errors.

Impact Analysis

If you use sipgo with stream transports like TCP, TLS, WS, or WSS, an attacker could send a malicious message with a large Content-Length header. This would consume excessive server memory, leading to service slowdowns or crashes, disrupting normal operations.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting system memory, which could lead to service unavailability. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements under both regulations. GDPR requires ensuring availability of personal data processing systems, and HIPAA mandates safeguards for electronic protected health information systems. A DoS condition could hinder compliance by preventing authorized access to critical systems.

Mitigation Strategies

Upgrade sipgo to version 1.4.1 or later to apply the patch that prevents excessive memory allocation. If immediate upgrade is not possible, implement network-level controls to limit message sizes or block oversized Content-Length headers.

Hi! I’m here to help you understand CVE-2026-58268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70