CVE-2026-90778 in SIPp
Summary
by MITRE • 09/13/2026
SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in SIPp versions through 3.7.7 represents a critical security flaw within the get_peer_tag() function, specifically triggered during the parsing of Session Initiation Protocol (SIP) To headers. This issue is classified as a buffer overflow, which corresponds to CWE-120: Buffer Copy without Checking Size of Input in standard vulnerability taxonomy. The root cause lies in the improper handling of input data where the application fails to validate the length of the tag parameter before copying it into a fixed-size static buffer. When an attacker provides a SIP message containing a To header with a tag parameter that exceeds or equals 2049 bytes, the excess data spills over the boundaries of the allocated memory space. This behavior is characteristic of classic stack-based buffer overflow vulnerabilities where input validation mechanisms are either absent or insufficiently rigorous to account for maximum expected payload sizes.
From an operational perspective, this vulnerability allows unauthenticated remote attackers to execute a denial-of-service attack against systems running SIPp. By sending crafted SIP messages with oversized tag parameters, the attacker can cause the process to crash due to memory corruption. While buffer overflows are often associated with arbitrary code execution, in the context of SIPp which is primarily used as a testing and load generation tool rather than a production signaling server, the immediate impact is service disruption. The crash prevents further processing of legitimate traffic or test scenarios, effectively rendering the application unavailable until it is restarted. This aligns with ATT&CK technique T1498: Network Denial of Service, where an adversary disrupts availability by exhausting resources or causing system instability through malformed inputs.
The significance of this vulnerability extends beyond simple service interruption if SIPp were deployed in environments where stability and continuous operation are critical for network testing infrastructure. An attacker could potentially use repeated crashes to exhaust administrative attention or mask other malicious activities during the recovery period. Furthermore, depending on the underlying operating system's memory protection mechanisms such as Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP), exploitation might be more complex than a simple crash, but the potential for remote code execution cannot be entirely ruled out without further analysis of the specific compiler flags and runtime environment. The lack of authentication required to exploit this flaw makes it particularly dangerous as any entity with network access to the SIPp instance can trigger the condition.
Mitigation strategies should focus on immediate patching and input validation enhancements. Users running versions of SIPp up to 3.7.7 are advised to upgrade to a patched version that addresses the buffer overflow in get_peer_tag(). In cases where upgrading is not immediately feasible, deploying network-level controls such as firewalls or intrusion prevention systems can help mitigate risk by filtering out SIP messages with abnormally large header fields before they reach the vulnerable application. Additionally, implementing strict input validation within custom builds of SIPp to enforce maximum length limits on tag parameters would prevent the overflow condition from occurring. Regular security audits and code reviews focusing on C/C++ memory management practices are recommended to identify similar vulnerabilities in other parts of the software stack that handle network protocol parsing.