CVE-2026-45538 in OpenSIPS
Summary
by MITRE • 08/05/2026
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in OpenSIPS versions 4.0.0 and prior represents a critical stack buffer overflow flaw that stems from improper bounds checking during SIP message processing. This vulnerability specifically targets the sip_to_json() function located in modules/sipmsgops/sipmsgops.c, where header names are copied into a fixed 255-byte stack buffer without adequate validation. The issue arises because the SIP parser itself does not impose limits on header name lengths, allowing for header names that can exceed the 255-byte buffer size by several orders of magnitude, with theoretical maximums reaching approximately 65000 bytes. When a routing script invokes sip_to_json(), the function performs a memcpy operation using the full header name length without bounds checking, creating a predictable exploitation scenario.
The technical execution of this vulnerability occurs through a single unauthenticated UDP packet sent to the standard SIP port 5060, making it particularly dangerous for network-based attacks. The buffer overflow specifically corrupts the saved frame pointer and return address on the stack, which fundamentally compromises the program's execution flow. This type of vulnerability maps directly to CWE-121 Stack-based Buffer Overflow, which is classified under the Common Weakness Enumeration framework as a critical security flaw involving insufficient bounds checking in stack memory operations. The exploitation potential extends beyond simple denial of service to include remote code execution capabilities when the application is compiled without stack protection mechanisms such as stack canaries or address space layout randomization.
The operational impact of this vulnerability affects all OpenSIPS deployments that utilize routing scripts containing calls to sip_to_json(), making it a widespread concern across various telephony infrastructure implementations. Attackers can leverage this flaw by crafting malicious SIP messages with excessively long header names, enabling them to either crash the OpenSIPS process or potentially gain remote code execution privileges depending on the system's security mitigations. The vulnerability also aligns with ATT&CK technique T1190 for exploiting vulnerabilities in software applications, specifically targeting the execution phase of an attack chain where adversaries seek to execute arbitrary code on compromised systems. Organizations using OpenSIPS should immediately implement network-level restrictions or disable the problematic routing functionality until a proper patch is available, as this vulnerability represents a direct pathway to system compromise without requiring authentication or complex attack vectors.
This vulnerability highlights significant gaps in input validation and memory management practices within SIP server implementations, particularly concerning the handling of user-controllable data in high-privilege contexts. The flaw demonstrates how seemingly benign parsing operations can become critical security risks when proper bounds checking mechanisms are omitted from core functions. Given that OpenSIPS serves as a foundational component for many VoIP infrastructure deployments, this vulnerability could potentially affect thousands of endpoints and systems worldwide, making it a prime target for exploitation in network reconnaissance and attack campaigns targeting telecommunications infrastructure. The lack of a patch at publication time further compounds the risk, leaving organizations with no immediate remediation path while maintaining the potential for widespread compromise through simple network-based attacks.