Is CVE-2026-45103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45103 being exploited in the wild.

How severe is CVE-2026-45103?

High severity, with a CVSS score of 7.5, published 4 August 2026.

Which products and versions are affected?

OpenSIPS prior to 3.6.6 and 4.0.0-rc1.

Is there a fix for CVE-2026-45103?

A patch was published on 2026-08-04: Fixed in versions 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45103 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-45103?

Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45103: OpenSIPS integer overflow in TCP message framing

CVE-2026-45103 · Severity: high · CVSS 7.5 · Published 2026-08-04

OpenSIPS is a Session Initiation Protocol (SIP) server used to route and manage voice and video calls in telecommunications networks. A flaw in the TCP message parsing layer allows unauthenticated attackers to bypass security policies by smuggling malformed SIP messages through the server, potentially enabling unauthorized call interception, redirection, or service disruption.

Technologies: OpenSIPS. Vendors: OpenSIPS.

Quick answers

Is CVE-2026-45103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45103 being exploited in the wild.
How severe is CVE-2026-45103?: High severity, with a CVSS score of 7.5, published 4 August 2026.
Which products and versions are affected?: OpenSIPS prior to 3.6.6 and 4.0.0-rc1.
Is there a fix for CVE-2026-45103?: A patch was published on 2026-08-04: Fixed in versions 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45103 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45103?: Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an integer overflow in the Content-Length header parsing of the TCP message framing layer (proto_tcp, proto_tls, proto_ws, proto_wss). When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the parser wraps the result (e.g., to 0), causing incorrect message boundary detection. This allows the TCP stream to be split at the wrong boundary, causing the body of one SIP message to be interpreted as a separate message. Since Content-Length parsing occurs before authentication, an unauthenticated network-based attacker can smuggle arbitrary SIP messages to bypass front-end security policies, inherit the connection's authentication context, and evade rate limiting. Patches are available in versions 3.6.6 and 4.0.0-rc1.

Affected products

OpenSIPS OpenSIPS prior to 3.6.6 and 4.0.0-rc1

Timeline

2026-08-04: disclosed: CVE-2026-45103 published
2026-08-04: patched: Fixed in versions 3.6.6 and 4.0.0-rc1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.