Executive brief
OpenSIPS is a Session Initiation Protocol (SIP) server used to route and manage voice and video calls in telecommunications networks. A flaw in the TCP message parsing layer allows unauthenticated attackers to bypass security policies by smuggling malformed SIP messages through the server, potentially enabling unauthorized call interception, redirection, or service disruption.
Technical details
The vulnerability is an integer overflow in the Content-Length header parsing of the TCP message framing layer (proto_tcp, proto_tls, proto_ws, proto_wss). When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the parser wraps the result (e.g., to 0), causing incorrect message boundary detection. This allows the TCP stream to be split at the wrong boundary, causing the body of one SIP message to be interpreted as a separate message. Since Content-Length parsing occurs before authentication, an unauthenticated network-based attacker can smuggle arbitrary SIP messages to bypass front-end security policies, inherit the connection's authentication context, and evade rate limiting. Patches are available in versions 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS prior to 3.6.6 and 4.0.0-rc1
Timeline
- 2026-08-04: disclosed: CVE-2026-45103 published
- 2026-08-04: patched: Fixed in versions 3.6.6 and 4.0.0-rc1