CVE-2026-45809 in OpenSIPS
Summary
by MITRE • 08/05/2026
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 represents a critical denial of service flaw within the watcherinfo generation functionality that stems from inadequate input validation and buffer management. This vulnerability specifically affects deployments where the presence and presence_xml modules are loaded and the handle_subscribe() function is accessible, creating an exploitable attack surface for remote adversaries. The issue manifests when an attacker crafts a malicious SUBSCRIBE request with an excessively long From URI parameter, leveraging the SIP protocol's presence subscription mechanism to trigger the problematic code path.
The technical execution of this vulnerability relies on a classic stack buffer overflow condition where OpenSIPS copies the attacker-controlled watcher URI into a fixed-size stack buffer without proper bounds checking. This fundamental flaw in memory management allows the malicious input to exceed the allocated buffer space, resulting in memory corruption that ultimately crashes the OpenSIPS worker process. The vulnerability operates at the application layer within the SIP processing pipeline, specifically targeting the presence.winfo XML generation component that handles watcher information for presence subscriptions. The buffer overflow occurs during the XML generation phase when the system attempts to store the oversized URI value, making it impossible for legitimate users to maintain service continuity.
The operational impact of this vulnerability extends beyond simple service disruption as it provides attackers with the capability to repeatedly crash OpenSIPS worker processes, leading to sustained denial of service conditions that can severely impact communication services relying on SIP infrastructure. This vulnerability affects organizations that deploy OpenSIPS as their primary SIP server implementation and expose presence subscription functionality to external networks. The configuration dependency aspect means that not all deployments are equally vulnerable, but those using the affected modules and routing configurations face significant risk of exploitation. The attack requires minimal sophistication and can be executed remotely without authentication, making it particularly dangerous in production environments where SIP services are critical for business operations.
Mitigation strategies should focus on immediate patching to versions 3.6.6 or 4.0.0-rc1 where the buffer overflow has been addressed through proper input validation and bounds checking mechanisms. Organizations should also implement network-level controls such as rate limiting for SUBSCRIBE requests and monitoring for unusually long URI values to detect potential exploitation attempts. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which is classified under the Common Weakness Enumeration framework as a critical security flaw requiring immediate remediation. From an ATT&CK perspective, this vulnerability maps to T1499.004 Network Denial of Service and T1595.001 Network Topology Discovery, as attackers can leverage it both for service disruption and to identify vulnerable system configurations. Additionally, implementing proper input sanitization and validation practices across all user-supplied data processing within SIP implementations would prevent similar vulnerabilities from emerging in future deployments.