Quick answers
- Is CVE-2026-45705 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45705 being exploited in the wild.
- How severe is CVE-2026-45705?
- Medium severity, with a CVSS score of 5.3, published 5 August 2026.
- Which products and versions are affected?
- OpenSIPS before 3.6.6 and before 4.0.0-rc1.
- Is there a fix for CVE-2026-45705?
- A patch was published on 2026-08-05: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45705 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-45705?
- Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The find_line_delimiter() function in OpenSIPS's multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. When a SIP message contains Content-Type: multipart/mixed with a boundary parameter and the body ends with -- (two hyphens) within 2–3 bytes of the buffer end without the actual boundary delimiter following, the function reads delimiter.len bytes (typically 20–70 bytes) past the logical end of the body, crossing memory boundaries. This is triggered remotely via a crafted SIP message sent to the server; no authentication is required. An attacker can cause information disclosure or denial of service. The vulnerability was fixed in versions 3.6.6 and 4.0.0-rc1 by adding buffer length validation before the delimiter comparison.
Affected products
- OpenSIPS OpenSIPS before 3.6.6 and before 4.0.0-rc1
Timeline
- 2026-08-05: disclosed
- 2026-08-05: patched: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1