CVE-2026-77322

Received Received - Intake

SIPGO Memory Exhaustion via Unbounded WS Frame Size

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-77322

EUVD

EUVD-2026-84818

Affected Vendors & Products

Vendor	Product	Version / Range
emiago	sipgo	to 1.4.3 (exc)
sipgo	sipgo	1.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in SIPGO (versions <= 1.4.2) is a denial-of-service (DoS) flaw in the WebSocket transport implementation. An unauthenticated attacker can send a maliciously crafted WebSocket frame with an extremely large declared payload length. This causes the server to attempt allocating an impossibly large buffer, triggering a panic and crashing the entire process due to an out-of-range slice size.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory exhaustion in SIPGO-based services when processing WebSocket connections. Check logs for 'makeslice length panic' errors or abnormal termination of sipgo processes. Use network traffic analysis tools like Wireshark to inspect WebSocket frames for unusually large payload declarations.

Impact Analysis

If exploited, this vulnerability can crash your SIPGO-based server, causing a denial-of-service. The server would become unavailable until manually restarted, disrupting all services relying on it. No authentication or user interaction is required for the attack, making it easy to execute remotely.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes or resource exhaustion, which could lead to service disruptions. While not directly violating GDPR or HIPAA, such disruptions may affect compliance with requirements for data availability and system reliability in regulated environments.

Mitigation Strategies

Immediately upgrade sipgo to version 1.4.3 or later. If upgrading is not possible, apply the patch by adding 'reader.MaxFrameSize = int64(ParseMaxMessageLength)' in sip/transport_ws.go. Restart affected services after applying changes. Monitor system resources for signs of resource exhaustion.

Hi! I’m here to help you understand CVE-2026-77322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70