Denial of Service Vulnerability in OpenSIPS Presence Module

CVE-2026-45084

What is CVE-2026-45084?

OpenSIPS versions 3.4.0 to 3.6.5 have a Denial of Service vulnerability related to the presence module. The issue arises when the handle_publish() function processes a SIP PUBLISH request, specifically when the Event: presence header and a corresponding message body are included. Under conditions where the configuration option enable_sphere_check is enabled, the function invokes get_content_type() without prior initialization by parse_content_type_hdr(). This oversight leads to dereferencing uninitialized or NULL Content-Type parsing states, potentially crashing the server. A remote attacker can exploit this vulnerability by sending a single PUBLISH request over UDP or TCP, capable of causing server downtime without requiring authentication directly through the vulnerable code path. This vulnerability has been addressed in versions 3.6.6 and 4.0.0-rc1.

References