Executive brief
OpenSIPS is a Session Initiation Protocol (SIP) server used to handle voice and video call routing across networks. An unauthenticated attacker can crash the server by sending a specially crafted SIP request with a malformed SDP bandwidth line, disrupting communications for all users dependent on that server instance.
Technical details
The vulnerability exists in the SDP bandwidth-line parsing logic in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. A SIP request with Content-Type: application/sdp containing a malformed session-level SDP bandwidth line missing the required colon delimiter causes memory corruption in the parsed SDP bandwidth metadata. When dialog or QoS processing modules clone the corrupted SDP state, the worker process crashes. The attack requires network-level SIP connectivity and no authentication; any routing configuration that parses attacker-controlled SDP and applies dialog/QoS processing is vulnerable. The fix was released in versions 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS prior to 3.6.6 and 4.0.0-rc1
Timeline
- 2026-08-05: disclosed