Executive brief
OpenSIPS is a Session Initiation Protocol (SIP) server used by telecommunications and VoIP service providers to route and manage voice calls. The presence module handles notifications about user availability status. A vulnerability in this module allows a remote attacker to crash an OpenSIPS instance by sending a specially crafted SIP PUBLISH request, causing service outage and disrupting call routing and presence notifications for all users on the affected server.
Technical details
The vulnerability is a NULL pointer dereference in the presence module's handle_publish() function. When processing a SIP PUBLISH request with Event: presence header and enable_sphere_check=1 configuration enabled, the code calls get_content_type() macro without first calling parse_content_type_hdr(). This causes a crash when msg->content_type->parsed is NULL (if Content-Type header is present but unparsed) or when msg->content_type is NULL (if Content-Type header is missing entirely). The attack requires only a single PUBLISH request over UDP or TCP and does not require authentication at the protocol level, though deployment routing configurations may enforce it. The vulnerability was fixed in OpenSIPS 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS 3.4.0 through 3.6.5, 4.0.0 through 4.0.0
Timeline
- 2026-05-21: disclosed: GitHub security advisory GHSA-h3ww-hchh-x2g9 published
- 2026-05-21: patched: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1
- 2026-08-04: other: CVE-2026-45084 published