Memory Allocation Issue in SIPGO Library for GO Language
CVE-2026-77322

7.5HIGH

Key Information:

Vendor

Emiago

Status
Sipgo
Vendor
CVE Published:
22 September 2026

What is CVE-2026-77322?

The SIPGO library, utilized for creating SIP services using the GO programming language, experiences a flaw prior to version 1.4.3. The WSConnection.Read function in transport_ws.go generates a wsutil.Reader without establishing a MaxFrameSize limit. This vulnerability allows an unauthenticated WebSocket (WS) or WebSocket Secure (WSS) peer to manipulate the frame header to declare an excessively large payload. The result is a risk of oversized memory allocation or a makeslice length panic, which could lead to server crashes or significant memory exhaustion. This issue has been addressed in version 1.4.3 of the SIPGO library.

Affected Version(s)

sipgo < 1.4.3

References

https://github.com/emiago/sipgo/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/emiago/sipgo/commit/769e4bc958376e2363...
x_refsource_MISC
https://github.com/emiago/sipgo/releases/tag/v1.4.3
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.