CVE-2026-90780
Received Received - Intake

Buffer Overflow in SIPp Due to Oversized SIP Headers

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulnCheck

Description
SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90780
EUVD
EUVD-2026-77004

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sipp sipp 3.7.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90780 is a buffer overflow vulnerability in SIPp through version 3.7.7. It occurs in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow a static buffer and crash the process.

Detection Guidance

To detect this vulnerability, monitor SIP traffic for messages with headers exceeding 20,490 bytes. Use Wireshark or tcpdump to capture SIP packets and filter for large headers. Check SIPp logs for crashes or errors during processing.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the SIPp application by sending specially crafted SIP messages with oversized headers. This could lead to denial-of-service conditions, disrupting SIP-based services or testing environments that rely on SIPp.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt SIP-based communication systems handling sensitive data. Buffer overflows may lead to service unavailability, potentially violating availability requirements in GDPR Article 32 and HIPAA Security Rule standards for ensuring access to protected health information.

Mitigation Strategies

Upgrade SIPp to a patched version that replaces unbounded sprintf with snprintf. If upgrading is not possible, filter or block oversized SIP headers at the network perimeter. Monitor for crashes or unusual SIP traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90780. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart