Executive brief
OpenSIPS is a Session Initiation Protocol (SIP) server that routes voice and messaging calls over IP networks. A buffer overflow in the construct_uri() function allows attackers to send specially crafted SIP messages that overwrite server memory, enabling them to disable security features (like rejecting overloaded calls) and alter the server's routing behavior, potentially disrupting call delivery or enabling further attacks.
Technical details
The construct_uri() function concatenates URI components (protocol, username, domain, port, parameters) into a fixed 1024-byte global buffer without bounds checking. When attacker-controlled username data exceeds the buffer capacity, a stack buffer overflow occurs, corrupting adjacent global variables including disable_503_translation, a flag that controls SIP 503 response handling. The vulnerability is reachable via routing scripts that process attacker-supplied usernames, requires no authentication, and allows deterministic exploitation across multiple requests. Patches are available in versions 3.6.6 and 4.0.0-rc1, implementing bounds validation on total URI length before writing components.
Affected products
- OpenSIPS OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1
Timeline
- 2026-08-04: disclosed
- 2026-08-04: patched: Fixed in versions 3.6.6 and 4.0.0-rc1