CVE-2026-90779 in SIPp
Summary
by MITRE • 09/13/2026
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified within SIPp versions up to 3.7.7 represents a critical security flaw located in the createAuthHeader function, which is responsible for constructing authentication headers during Session Initiation Protocol interactions. This specific implementation error manifests as a stack buffer overflow, occurring when the software processes SIP authentication challenges that contain oversized algorithm parameters. The root cause lies in insufficient validation of input data length before it is copied into fixed-size buffers on the call stack. When a malicious actor controls the size or content of these algorithm parameters, they can exceed the allocated memory boundaries, leading to corruption of adjacent stack memory regions including return addresses and saved frame pointers.
From an operational perspective, this vulnerability allows for remote code execution potential if exploited with precision, though in many cases it results in immediate denial of service through process termination. A malicious SIP server or a man-in-the-middle attacker can craft specific 401 Unauthorized or 407 Proxy Authentication Required responses that trigger the overflow condition upon receipt by the vulnerable client application running SIPp. The resulting stack corruption typically causes the application to crash, disrupting testing sessions and potentially exposing sensitive debugging information if core dumps are generated in unsecured environments. This behavior aligns with CWE-121, which classifies stack-based buffer overflows as a category of memory safety violations where data is written beyond the allocated boundary due to improper bounds checking.
The exploitation vector for this flaw requires network access to send crafted SIP messages, placing it within the scope of remote attacks that do not require user interaction once the connection is established. In terms of threat modeling and adversary behavior, this vulnerability corresponds to ATT&CK technique T1059, specifically command execution via script interpretation or binary exploitation if further payload delivery mechanisms are chained with other vulnerabilities. The lack of input sanitization for algorithm parameter lengths in older versions of SIPp highlights a common oversight in security-focused testing tools where the assumption is often that inputs will be well-formed according to RFC standards rather than being treated as potentially hostile data from untrusted sources.
Mitigation strategies primarily involve upgrading to patched versions of SIPp released after version 3.7.7, which include fixes for input validation and buffer size checks within the createAuthHeader function. For environments where immediate patching is not feasible, network-level controls such as deep packet inspection firewalls can be configured to detect and block SIP messages with anomalously large algorithm parameters in authentication challenges. Additionally, developers should implement strict length verification before any string copy operations occur on the stack and consider using safer memory handling functions that enforce bounds checking automatically. Regular security audits of testing toolchains are essential to ensure that tools used for vulnerability assessment do not themselves become vectors for exploitation due to similar implementation flaws.