Executive brief
OpenSIPS is a SIP server used by telecommunications and VoIP platforms to manage call sessions. A remote attacker can crash OpenSIPS by sending a specially crafted SUBSCRIBE request with a long sender URI, causing the watcherinfo XML generation to overflow an internal buffer. This leads to service interruption for all VoIP calls routed through the affected system.
Technical details
The vulnerability is a stack buffer overflow in the watcherinfo (presence.winfo) XML generation functionality within OpenSIPS's presence module. An attacker sends a SUBSCRIBE Event: presence request with an excessively long From URI to create an oversized watcher entry. When the watcherinfo XML is later generated for the same presentity, the code copies the stored watcher URI into a fixed-size stack buffer without bounds checking, causing a stack overflow that crashes the OpenSIPS worker process. The attack is network-reachable and requires no authentication, but only works in deployments where the presence and presence_xml modules are loaded and SUBSCRIBE routing is exposed. Fixes are available in versions 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1
Timeline
- 2026-08-05: disclosed
- 2026: patched: Versions 3.6.6 and 4.0.0-rc1