Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.
Published: 2026-08-04
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the OpenSIPS presence module’s handle_publish() function, which uses the get_content_type() macro without prior parsing of the Content-Type header. When a SIP PUBLISH request carries an Event: presence header and a message body, but the enable_sphere_check option is set to 1, the code dereferences uninitialized or NULL content type state. This results in a crash of the SIP server, freezing the instance. The exploit is straightforward: a single crafted PUBLISH message is sufficient to trigger the crash. The flaw does not require prior authentication, although an application’s routing rules might add an extra barrier before reaching the vulnerable code path.

Affected Systems

OpenSIPS server implementations, specifically versions 3.4.0 through 3.6.5, are affected. The issue has been resolved in 3.6.6 and the 4.0.0‑rc1 releases. Systems running these vulnerable versions must be upgraded to mitigate the risk.

Risk and Exploitability

With a CVSS score of 8.7, this is a high‑severity denial of service. The exploit probability is undefined (no EPSS available), and it is not listed in the CISA KEV catalog. The vulnerability can be triggered remotely over UDP or TCP by sending a single PUBLISH request, either with a valid Content‑Type: application/pidf+xml header or with the header omitted, regardless of whether the request is authenticated. The denial of service occurs as soon as the OpenSIPS process crashes, potentially impacting all SIP services on the host.

Generated by OpenCVE AI on August 4, 2026 at 22:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the OpenSIPS instance to version 3.6.6 or later (or 4.0.0‑rc1 and subsequent releases) to apply the vendor fix.
  • If upgrading is not immediately possible, disable the presence module or block PUBLISH traffic from untrusted networks at the firewall or ACL level to prevent the crash.
  • Ensure that any application‑level authentication or routing rules that guard the presence route are enforced, so that only authorized traffic can reach the handle_publish() code path.

Generated by OpenCVE AI on August 4, 2026 at 22:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Opensips
Opensips opensips
Vendors & Products Opensips
Opensips opensips

Tue, 04 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.
Title OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Opensips Opensips
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-05T14:16:11.377Z

Reserved: 2026-05-08T18:45:10.097Z

Link: CVE-2026-45084

cve-icon Vulnrichment

Updated: 2026-08-05T14:16:08.009Z

cve-icon NVD

Status : Received

Published: 2026-08-04T22:17:14.493

Modified: 2026-08-05T15:16:47.353

Link: CVE-2026-45084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T23:00:14Z

Weaknesses