Executive brief
OpenSIPS is a VoIP server that processes Session Initiation Protocol (SIP) messages used in telecommunications systems. A buffer overflow vulnerability in the base64 encoding function allows remote attackers to send specially crafted SIP messages that corrupt adjacent memory buffers, potentially leading to code execution or service disruption. Exploitation requires the server's routing configuration to apply base64 encoding to attacker-controlled input.
Technical details
The vulnerability is a heap buffer overflow in the {s.b64encode} string transformation. The input size validation only checks that data fits within a 64 KB transformation buffer, but base64 encoding expands data by approximately 33%, causing inputs between 49,153 and 65,535 bytes to produce output exceeding buffer capacity by up to 21,844 bytes. These transformation buffers are allocated adjacently in memory and reused for chained transformations, allowing the overflow to write attacker-controlled data into adjacent buffers and corrupt values used in subsequent transformations of the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (approximately 50,000+ bytes) when the routing script applies {s.b64encode} to untrusted input. Exploitation depends on the specific routing script configuration. Patches are available in versions 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS 3.4.0-beta through 3.6.5, 4.0.0-beta
Timeline
- 2026-08-04: disclosed