Executive brief
OpenSIPS is a Session Initiation Protocol (SIP) server that routes and processes phone calls and messaging traffic. A vulnerability in the sip_to_json() function allows an attacker to crash the SIP server or execute arbitrary code by sending a specially crafted SIP message with an exceptionally long header name. Since this function processes unauthenticated incoming messages, a single malicious packet sent to the default SIP port can disable the service or compromise the entire system.
Technical details
The vulnerability is a stack buffer overflow in the sip_to_json() function within modules/sipmsgops/sipmsgops.c (lines 2118–2152). The function copies SIP header names into a fixed 255-byte stack buffer using memcpy() without bounds checking, despite the SIP parser allowing header names up to approximately 65,000 bytes. An attacker sends a SIP message (INVITE, REGISTER, etc.) with a custom header whose name exceeds 255 bytes, triggering the overflow. The overflow is fully attacker-controlled in both size and content, allowing corruption of saved registers and the return address on the stack. No authentication is required; the function processes messages before any SIP auth checks. Exploitation results in immediate denial of service (crash) on hardened builds, or remote code execution via return-address hijacking on standard builds without stack protections. Patches were released in versions 3.6.6 and 4.0.1.
Affected products
- OpenSIPS OpenSIPS 3.6.0 through 3.6.5, 4.0.0 and prior
Timeline
- 2026-05-21: disclosed: GitHub Security Advisory GHSA-37wc-5j8j-95x3 published
- 2026: patched: Fixed in versions 3.6.6 and 4.0.1
- 2026-08-04: advisory: NVD CVE-2026-45538 published