# CVE-2026-45537: OpenSIPS construct_uri buffer overflow

Source: https://junglewise.ai/threats/cve-2026-45537-opensips-construct-uri-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45537 · Severity: critical · CVSS 9.1 · Published 2026-08-04

OpenSIPS is a Session Initiation Protocol (SIP) server that routes voice and messaging calls over IP networks. A buffer overflow in the construct_uri() function allows attackers to send specially crafted SIP messages that overwrite server memory, enabling them to disable security features (like rejecting overloaded calls) and alter the server's routing behavior, potentially disrupting call delivery or enabling further attacks.

Technologies: [OpenSIPS](https://junglewise.ai/threats/technologies/opensips). Vendors: [OpenSIPS](https://junglewise.ai/threats/vendors/opensips).

## Quick answers

**Is CVE-2026-45537 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45537 being exploited in the wild.

**How severe is CVE-2026-45537?** Critical severity, with a CVSS score of 9.1, published 4 August 2026.

**Which products and versions are affected?** OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1.

**Is there a fix for CVE-2026-45537?** A patch was published on 2026-08-04: Fixed in versions 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45537 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45537?** Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The construct_uri() function concatenates URI components (protocol, username, domain, port, parameters) into a fixed 1024-byte global buffer without bounds checking. When attacker-controlled username data exceeds the buffer capacity, a stack buffer overflow occurs, corrupting adjacent global variables including disable_503_translation, a flag that controls SIP 503 response handling. The vulnerability is reachable via routing scripts that process attacker-supplied usernames, requires no authentication, and allows deterministic exploitation across multiple requests. Patches are available in versions 3.6.6 and 4.0.0-rc1, implementing bounds validation on total URI length before writing components.

## Affected products

- OpenSIPS OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1

## Timeline

- 2026-08-04: disclosed
- 2026-08-04: patched: Fixed in versions 3.6.6 and 4.0.0-rc1

## References

- [https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb](https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb)
- [https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668](https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668)

## Related threats

- [OpenSIPS SDP bandwidth-line parsing denial of service](https://junglewise.ai/threats/cve-2026-46334-opensips-sdp-bandwidth-line-parsing-denial-of-service)
- [OpenSIPS watcherinfo stack buffer overflow](https://junglewise.ai/threats/cve-2026-45809-opensips-watcherinfo-stack-buffer-overflow)
- [OpenSIPS out-of-bounds read in multipart body parser](https://junglewise.ai/threats/cve-2026-45705-opensips-out-of-bounds-read-in-multipart-body-parser)
- [OpenSIPS integer overflow in TCP message framing](https://junglewise.ai/threats/cve-2026-45103-opensips-integer-overflow-in-tcp-message-framing)
- [OpenSIPS buffer overflow in b64encode string transformation](https://junglewise.ai/threats/cve-2026-45100-opensips-buffer-overflow-in-b64encode-string-transformation)