CVE-2026-45100 in OpenSIPS
Summary
by MITRE • 08/05/2026
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The OpenSIPS SIP server implementation contains a critical buffer overflow vulnerability in its string transformation functionality that affects versions 3.4.0-beta through 3.6.5 and 4.0.0-beta. This vulnerability stems from inadequate size validation within the base64 encoding function s.b64encode which operates on data transformation buffers. The flaw manifests when processing input data that exceeds approximately 49,153 bytes but remains below 65,535 bytes, creating a scenario where base64 encoding expansion causes buffer overflow due to the inherent 33% size increase of encoded data. The technical implementation fails to account for this expansion factor during buffer size validation, creating a direct pathway for memory corruption.
The operational impact of this vulnerability is significant as it allows remote attackers to execute arbitrary code through carefully crafted SIP messages containing oversized header values. The attack vector requires that the target deployment's routing script processes attacker-controlled input through the s.b64encode transformation, making exploitability dependent on specific configuration patterns. The vulnerability operates at the intersection of memory management and string processing within the SIP message handling pipeline, where chained transformations share adjacent memory buffers. This architectural design flaw means that overflowed data can overwrite values used by subsequent transformations in the same SIP message processing flow, potentially leading to complete system compromise.
The buffer overflow occurs because the 64 KB transformation buffer only accounts for input size without considering base64 encoding expansion, creating a gap where up to 21,844 bytes of attacker-controlled data can overwrite adjacent memory regions. This memory corruption affects the integrity of subsequent transformations and can be leveraged to manipulate program execution flow through classic stack-based exploitation techniques. The vulnerability maps directly to CWE-121 Stack-based Buffer Overflow and aligns with ATT&CK technique T1059.007 for command and scripting interpreter, specifically targeting application-level input validation failures. Attackers can exploit this through SIP protocol message injection attacks that trigger the vulnerable code path during normal operation.
Mitigation strategies include immediate deployment of patched versions 3.6.6 and 4.0.0-rc1 which implement proper size validation accounting for base64 expansion factors. Network administrators should also consider implementing SIP message filtering rules to limit header sizes and monitor for unusual traffic patterns that might indicate exploitation attempts. Additional protective measures include restricting access to OpenSIPS services through firewalls, implementing intrusion detection systems that monitor for known exploit signatures, and conducting thorough security audits of routing scripts to identify potential vulnerable transformation chains. The fix demonstrates proper input validation practices that align with secure coding guidelines and represents a defensive programming approach that prevents similar buffer overflow scenarios in future implementations.