Stack Buffer Overflow in OpenSIPS SIP Server Implementation

CVE-2026-45538

What is CVE-2026-45538?

OpenSIPS, a popular Session Initiation Protocol (SIP) server implementation, is susceptible to a stack buffer overflow vulnerability. In versions up to and including 4.0.0, the function sip_to_json() fails to properly validate SIP message header names. When a SIP message contains a header name exceeding 255 bytes, the lack of bound checks can lead to buffer overflow during the copying process. This may result in the corruption of the saved frame pointer and return address, enabling attackers to crash the server or potentially execute arbitrary code remotely by exploiting crafted SIP messages sent via UDP. Users deploying routing scripts that invoke sip_to_json() are particularly at risk, carrying a significant security threat in environments reliant on OpenSIPS.

References