# CVE-2026-45705: OpenSIPS out-of-bounds read in multipart body parser

Source: https://junglewise.ai/threats/cve-2026-45705-opensips-out-of-bounds-read-in-multipart-body-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45705 · Severity: medium · CVSS 5.3 · Published 2026-08-05

OpenSIPS is a SIP (Voice over IP) server used by telecom carriers and VoIP providers to route and manage call signaling. A flaw in its multipart message parser allows a specially crafted SIP message to read memory beyond buffer boundaries, potentially exposing sensitive data from the server's memory or causing the service to crash.

Technologies: [OpenSIPS](https://junglewise.ai/threats/technologies/opensips). Vendors: [OpenSIPS](https://junglewise.ai/threats/vendors/opensips).

## Quick answers

**Is CVE-2026-45705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45705 being exploited in the wild.

**How severe is CVE-2026-45705?** Medium severity, with a CVSS score of 5.3, published 5 August 2026.

**Which products and versions are affected?** OpenSIPS before 3.6.6 and before 4.0.0-rc1.

**Is there a fix for CVE-2026-45705?** A patch was published on 2026-08-05: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45705 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45705?** Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The find_line_delimiter() function in OpenSIPS's multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. When a SIP message contains Content-Type: multipart/mixed with a boundary parameter and the body ends with -- (two hyphens) within 2–3 bytes of the buffer end without the actual boundary delimiter following, the function reads delimiter.len bytes (typically 20–70 bytes) past the logical end of the body, crossing memory boundaries. This is triggered remotely via a crafted SIP message sent to the server; no authentication is required. An attacker can cause information disclosure or denial of service. The vulnerability was fixed in versions 3.6.6 and 4.0.0-rc1 by adding buffer length validation before the delimiter comparison.

## Affected products

- OpenSIPS OpenSIPS before 3.6.6 and before 4.0.0-rc1

## Timeline

- 2026-08-05: disclosed
- 2026-08-05: patched: Fixed in OpenSIPS 3.6.6 and 4.0.0-rc1

## References

- [https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb](https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb)
- [https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668](https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668)

## Related threats

- [OpenSIPS SDP bandwidth-line parsing denial of service](https://junglewise.ai/threats/cve-2026-46334-opensips-sdp-bandwidth-line-parsing-denial-of-service)
- [OpenSIPS watcherinfo stack buffer overflow](https://junglewise.ai/threats/cve-2026-45809-opensips-watcherinfo-stack-buffer-overflow)
- [OpenSIPS construct_uri buffer overflow](https://junglewise.ai/threats/cve-2026-45537-opensips-construct-uri-buffer-overflow)
- [OpenSIPS integer overflow in TCP message framing](https://junglewise.ai/threats/cve-2026-45103-opensips-integer-overflow-in-tcp-message-framing)
- [OpenSIPS buffer overflow in b64encode string transformation](https://junglewise.ai/threats/cve-2026-45100-opensips-buffer-overflow-in-b64encode-string-transformation)