Nil Pointer Dereference Vulnerability in SIPGO Library by Emiago
CVE-2025-68274

8.7HIGH

Key Information:

Vendor

Emiago

Status
Sipgo
Vendor
CVE Published:
16 December 2025

What is CVE-2025-68274?

The SIPGO library, utilized for developing SIP services in Go, has a nil pointer dereference vulnerability in its NewResponseFromRequest function. This vulnerability impacts all standard SIP operations by enabling remote attackers to crash any SIP application through a single malformed SIP request that omits the To header. During the parsing of SIP messages, the function erroneously assumes the To header is present, resulting in an unhandled nil pointer that disrupts essential functions such as call setup, authentication, and message handling. The issue is present in all versions from 0.3.0 up to 1.0.0-alpha and is mitigated in version 1.0.0-alpha-1.

Affected Version(s)

sipgo >= v0.3.0, < v1.0.0-alpha-1

References

https://github.com/emiago/sipgo/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/emiago/sipgo/commit/dc9669364a154ec6d1...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.