CVE-2026-46334 in OpenSIPS
Summary
by MITRE • 08/05/2026
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability under discussion affects OpenSIPS, a widely deployed Session Initiation Protocol server implementation that serves as the backbone for voice and video communication systems in telecommunications networks. This denial of service flaw resides within the SDP bandwidth-line parsing mechanism, specifically targeting how the system handles malformed session-level SDP bandwidth lines lacking the required colon delimiter. The issue manifests when processing SIP requests containing Content-Type: application/sdp where the SDP content contains corrupted bandwidth metadata due to missing delimiters. According to CWE-129, this represents an input validation vulnerability that allows for improper handling of malformed data inputs. The vulnerability operates at the protocol parsing layer, making it particularly dangerous as it can be exploited through standard SIP communication channels without requiring authentication or privileged access.
The technical exploitation occurs when OpenSIPS processes a SIP request with malformed SDP content that bypasses normal validation checks. When the system attempts to parse the bandwidth line, the missing colon delimiter causes the parser to misinterpret the data structure, resulting in corrupted metadata within the SDP state. This corruption becomes particularly problematic during subsequent processing phases where modules perform operations such as dialog management and Quality of Service handling. The vulnerability's impact extends beyond simple parsing errors because when the system attempts to clone this corrupted SDP state for further processing, the malformed data structures cause memory corruption that ultimately leads to worker process crashes. This behavior aligns with ATT&CK technique T1498 which describes denial of service attacks targeting application availability through resource exhaustion or process termination.
The operational impact of this vulnerability is significant for organizations relying on OpenSIPS for their communication infrastructure, as it can be triggered remotely by unauthenticated attackers without requiring any special privileges or access credentials. The crash occurs during normal processing flows when routing scripts encounter attacker-controlled SDP content and apply standard dialog or QoS processing logic that involves cloning SDP state information. This means that any deployment configuration that processes SIP requests containing potentially malicious SDP content and subsequently applies dialog or QoS processing is vulnerable to this attack vector. The vulnerability affects both the 3.x and 4.x release branches, indicating it was a fundamental parsing flaw rather than a temporary issue in specific implementations. Organizations using OpenSIPS in production environments face potential service disruption risks when exposed to this vulnerability, as attackers can repeatedly trigger crashes to maintain denial of service conditions.
The fix implemented in versions 3.6.6 and 4.0.0-rc1 addresses the core parsing logic by introducing proper validation checks for SDP bandwidth-line format requirements. This remediation ensures that malformed bandwidth lines containing missing colon delimiters are properly detected and handled without causing process termination. The solution likely involves enhanced input validation routines that check for required formatting elements before attempting to parse SDP content, preventing the corruption of metadata structures that leads to subsequent crashes during state cloning operations. Security teams should prioritize upgrading to these fixed versions while implementing monitoring solutions to detect potential exploitation attempts through anomalous SIP traffic patterns. Additionally, organizations should consider implementing network-level filtering rules to restrict potentially malicious SDP content and establish incident response procedures for handling service disruptions caused by this vulnerability. The fix demonstrates the importance of robust input validation in protocol implementations and highlights how seemingly minor parsing errors can lead to critical system instability issues affecting enterprise communication infrastructure.