Quick answers
- Is CVE-2026-46334 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46334 being exploited in the wild.
- How severe is CVE-2026-46334?
- Informational severity, published 5 August 2026.
- Which products and versions are affected?
- OpenSIPS prior to 3.6.6 and 4.0.0-rc1.
- Is there a fix for CVE-2026-46334?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-46334 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-46334?
- Check whether you run OpenSIPS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the SDP bandwidth-line parsing logic in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. A SIP request with Content-Type: application/sdp containing a malformed session-level SDP bandwidth line missing the required colon delimiter causes memory corruption in the parsed SDP bandwidth metadata. When dialog or QoS processing modules clone the corrupted SDP state, the worker process crashes. The attack requires network-level SIP connectivity and no authentication; any routing configuration that parses attacker-controlled SDP and applies dialog/QoS processing is vulnerable. The fix was released in versions 3.6.6 and 4.0.0-rc1.
Affected products
- OpenSIPS OpenSIPS prior to 3.6.6 and 4.0.0-rc1
Timeline
- 2026-08-05: disclosed