Executive brief
SIPGO is a SIP protocol library used to build telephony and VoIP applications. A vulnerability in its WebSocket transport allows an unauthenticated attacker to crash the entire server process by sending a malformed WebSocket frame with an extremely large declared payload length. This causes immediate service outage and can be triggered repeatedly without authentication.
Technical details
The vulnerability exists in WSConnection.Read, which allocates a buffer based on the WebSocket frame header's declared length field before validating the value. The length field is client-controlled and can be up to 2^63-1 (signed 64-bit integer). When an attacker sends a frame declaring an excessively large length (e.g., 2^63-1), the make() call panics due to slice size limits. SIPGO does not recover from this panic, crashing the entire server process. The attack requires only network reachability and a completed WebSocket handshake; no authentication is needed. The fix is to set MaxFrameSize limits on the wsutil.NewReader call.
Affected products
- SIPGO sipgo up to v1.4.0
Timeline
- 2026-09-22: disclosed: GitHub advisory GHSA-8h6x-h86x-75wh published
- 2026: other: CVE-2026-77322 assigned