OpenSIPS prior 3.6.6/4.0.0-rc1 Watcherinfo Generation presence.winfo handle_subscribe stack-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in OpenSIPS. This affects the function handle_subscribe of the file presence.winfo of the component Watcherinfo Generation. The manipulation leads to stack-based overflow. This vulnerability is listed as CVE-2026-45809. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in OpenSIPS. This issue affects the function handle_subscribe of the file presence.winfo of the component Watcherinfo Generation. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-45809 since 05/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.6.6 or 4.0.0-rc1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-53002). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• OpenSIPS

Website

• Product: https://github.com/OpenSIPS/opensips/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion