# CVE-2026-45538: OpenSIPS stack buffer overflow in sip_to_json header parsing

Source: https://junglewise.ai/threats/cve-2026-45538-opensips-stack-buffer-overflow-in-sip-to-json-header-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45538 · Severity: critical · CVSS 9.8 · Published 2026-08-04

OpenSIPS is a Session Initiation Protocol (SIP) server that routes and processes phone calls and messaging traffic. A vulnerability in the sip_to_json() function allows an attacker to crash the SIP server or execute arbitrary code by sending a specially crafted SIP message with an exceptionally long header name. Since this function processes unauthenticated incoming messages, a single malicious packet sent to the default SIP port can disable the service or compromise the entire system.

Technologies: [OpenSIPS](https://junglewise.ai/threats/technologies/opensips). Vendors: [OpenSIPS](https://junglewise.ai/threats/vendors/opensips).

## Quick answers

**Is CVE-2026-45538 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45538 being exploited in the wild.

**How severe is CVE-2026-45538?** Critical severity, with a CVSS score of 9.8, published 4 August 2026.

**Which products and versions are affected?** OpenSIPS 3.6.0 through 3.6.5, 4.0.0 and prior.

**Is there a fix for CVE-2026-45538?** A patch was published on 2026: Fixed in versions 3.6.6 and 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45538 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45538?** Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack buffer overflow in the sip_to_json() function within modules/sipmsgops/sipmsgops.c (lines 2118–2152). The function copies SIP header names into a fixed 255-byte stack buffer using memcpy() without bounds checking, despite the SIP parser allowing header names up to approximately 65,000 bytes. An attacker sends a SIP message (INVITE, REGISTER, etc.) with a custom header whose name exceeds 255 bytes, triggering the overflow. The overflow is fully attacker-controlled in both size and content, allowing corruption of saved registers and the return address on the stack. No authentication is required; the function processes messages before any SIP auth checks. Exploitation results in immediate denial of service (crash) on hardened builds, or remote code execution via return-address hijacking on standard builds without stack protections. Patches were released in versions 3.6.6 and 4.0.1.

## Affected products

- OpenSIPS OpenSIPS 3.6.0 through 3.6.5, 4.0.0 and prior

## Timeline

- 2026-05-21: disclosed: GitHub Security Advisory GHSA-37wc-5j8j-95x3 published
- 2026: patched: Fixed in versions 3.6.6 and 4.0.1
- 2026-08-04: advisory: NVD CVE-2026-45538 published

## References

- [https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3](https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3)

## Related threats

- [OpenSIPS SDP bandwidth-line parsing denial of service](https://junglewise.ai/threats/cve-2026-46334-opensips-sdp-bandwidth-line-parsing-denial-of-service)
- [OpenSIPS watcherinfo stack buffer overflow](https://junglewise.ai/threats/cve-2026-45809-opensips-watcherinfo-stack-buffer-overflow)
- [OpenSIPS out-of-bounds read in multipart body parser](https://junglewise.ai/threats/cve-2026-45705-opensips-out-of-bounds-read-in-multipart-body-parser)
- [OpenSIPS construct_uri buffer overflow](https://junglewise.ai/threats/cve-2026-45537-opensips-construct-uri-buffer-overflow)
- [OpenSIPS integer overflow in TCP message framing](https://junglewise.ai/threats/cve-2026-45103-opensips-integer-overflow-in-tcp-message-framing)