Executive brief
OpenSIPS is a SIP (Voice over IP) server used by telecom carriers and VoIP providers to route and manage call signaling. A flaw in its multipart message parser allows a specially crafted SIP message to read memory beyond buffer boundaries, potentially exposing sensitive data from the server's memory or causing the service to crash.
Technical details
The find_line_delimiter() function in OpenSIPS's multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. When a SIP message contains Content-Type: multipart/mixed with a boundary parameter and the body ends with -- (two hyphens) within 2–3 bytes of the buffer end without the actual boundary delimiter following, the function reads delimiter.len bytes (typically 20–70 bytes) past the logical end of the body, crossing memory boundaries. This is triggered remotely via a crafted SIP message sent to the server; no authentication is required. An attacker can cause information disclosure or denial of service. The vulnerability was fixed in versions 3.6.6 and 4.0.0-rc1 by adding buffer length validation before the delimiter comparison.
Affected products
- OpenSIPS OpenSIPS before 3.6.6 and before 4.0.0-rc1
Timeline
- 2026-08-05: disclosed
- 2026-08-05: patched: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1