Buffer Overflow Vulnerability in OpenSIPS SIP Server Affecting Versions Prior to 3.6.6 and 4.0.0-rc1
CVE-2026-45537
What is CVE-2026-45537?
OpenSIPS, a widely-used Session Initiation Protocol (SIP) server implementation, has experienced a buffer overflow vulnerability due to improper handling of URI components. Prior to versions 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenated multiple URI elements—such as protocol, username, domain, and port—into a fixed 1024-byte global buffer without proper bounds checking. This oversight allows an attacker to exploit the function by submitting a long username, leading to buffer overflow, which corrupts adjacent global data. The attacker's controlled content can alter critical flags, such as the disable_503_translation flag, influencing the server’s routing behavior. This vulnerability not only impacts the URI processing but also adversely affects the contact_builder() function due to shared buffer usage. Users are encouraged to update to the latest versions to mitigate this risk.
Affected Version(s)
opensips >= 3.4.0, < 3.6.6 < 3.4.0, 3.6.6
opensips >= 4.0.0-beta, < 4.0.0-rc1 < 4.0.0-beta, 4.0.0-rc1