# CVE-2026-45809: OpenSIPS watcherinfo stack buffer overflow

Source: https://junglewise.ai/threats/cve-2026-45809-opensips-watcherinfo-stack-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45809 · Severity: info · CVSS 7.5 · Published 2026-08-05

OpenSIPS is a SIP server used by telecommunications and VoIP platforms to manage call sessions. A remote attacker can crash OpenSIPS by sending a specially crafted SUBSCRIBE request with a long sender URI, causing the watcherinfo XML generation to overflow an internal buffer. This leads to service interruption for all VoIP calls routed through the affected system.

Technologies: [OpenSIPS](https://junglewise.ai/threats/technologies/opensips). Vendors: [OpenSIPS](https://junglewise.ai/threats/vendors/opensips).

## Quick answers

**Is CVE-2026-45809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45809 being exploited in the wild.

**How severe is CVE-2026-45809?** Informational severity, with a CVSS score of 7.5, published 5 August 2026.

**Which products and versions are affected?** OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1.

**Is there a fix for CVE-2026-45809?** A patch was published on 2026: Versions 3.6.6 and 4.0.0-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45809 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45809?** Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack buffer overflow in the watcherinfo (presence.winfo) XML generation functionality within OpenSIPS's presence module. An attacker sends a SUBSCRIBE Event: presence request with an excessively long From URI to create an oversized watcher entry. When the watcherinfo XML is later generated for the same presentity, the code copies the stored watcher URI into a fixed-size stack buffer without bounds checking, causing a stack overflow that crashes the OpenSIPS worker process. The attack is network-reachable and requires no authentication, but only works in deployments where the presence and presence_xml modules are loaded and SUBSCRIBE routing is exposed. Fixes are available in versions 3.6.6 and 4.0.0-rc1.

## Affected products

- OpenSIPS OpenSIPS prior to 3.6.6 and prior to 4.0.0-rc1

## Timeline

- 2026-08-05: disclosed
- 2026: patched: Versions 3.6.6 and 4.0.0-rc1

## References

- [https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd](https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd)
- [https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d](https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d)

## Related threats

- [OpenSIPS SDP bandwidth-line parsing denial of service](https://junglewise.ai/threats/cve-2026-46334-opensips-sdp-bandwidth-line-parsing-denial-of-service)
- [OpenSIPS out-of-bounds read in multipart body parser](https://junglewise.ai/threats/cve-2026-45705-opensips-out-of-bounds-read-in-multipart-body-parser)
- [OpenSIPS construct_uri buffer overflow](https://junglewise.ai/threats/cve-2026-45537-opensips-construct-uri-buffer-overflow)
- [OpenSIPS integer overflow in TCP message framing](https://junglewise.ai/threats/cve-2026-45103-opensips-integer-overflow-in-tcp-message-framing)
- [OpenSIPS buffer overflow in b64encode string transformation](https://junglewise.ai/threats/cve-2026-45100-opensips-buffer-overflow-in-b64encode-string-transformation)