Is CVE-2026-90778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90778 being exploited in the wild.

How severe is CVE-2026-90778?

High severity, with a CVSS score of 7.5, published 13 September 2026.

Is there a fix for CVE-2026-90778?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90778 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90778?

Check whether you run SIPp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90778: SIPp buffer overflow in get_peer_tag() function

CVE-2026-90778 · Severity: high · CVSS 7.5 · Published 2026-09-13

SIPp is a widely-used testing tool for Session Initiation Protocol (SIP) applications. The tool contains a buffer overflow vulnerability in its SIP message parser that can be triggered by sending a specially crafted message with an oversized tag parameter. An unauthenticated attacker on the network can exploit this to crash the SIPp process, causing testing services to become unavailable.

Technologies: SIPp. Vendors: SIPp.

Quick answers

Is CVE-2026-90778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90778 being exploited in the wild.
How severe is CVE-2026-90778?: High severity, with a CVSS score of 7.5, published 13 September 2026.
Which products and versions are affected?: SIPp through 3.7.7.
Is there a fix for CVE-2026-90778?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90778 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90778?: Check whether you run SIPp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic stack-based buffer overflow in the get_peer_tag() function within the SIP parser (sip_parser.cpp). The function fails to properly validate the length of the tag parameter in SIP To headers, allowing an attacker to write beyond the bounds of a static buffer when processing tag parameters of 2049 bytes or more. The attack requires no authentication and is triggered by sending a single crafted SIP message over the network. Successful exploitation results in process crash (denial of service); remote code execution is theoretically possible depending on memory layout and compiler protections. Patches are expected to be available in versions after 3.7.7.

Affected products

SIPp SIPp through 3.7.7

Timeline

2026-09-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.