A TCP Content-Length integer overflow in OpenSIPS allows a network attacker to send a header value that wraps the unsigned integer, causing the server to split the stream incorrectly. The body of the first SIP message is treated as a second, separate message, enabling smuggling of arbitrary SIP commands. Because the vulnerable parsing occurs before authentication, the attacker can use any TCP‑based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on a server with TCP enabled, bypassing front‑end SBC or proxy security policies, inheriting the connection’s authentication context, and evading rate limiting.

The issue affects OpenSIPS servers running any version earlier than 3.6.6 or before the 4.0.0‑rc1 release. Both the community editions (OpenSIPS:opensips) and any deployments that enable TCP‑based transports are vulnerable, regardless of platform or operating system.

The vulnerability has a CVSS score of 7.5, indicating moderate‑high risk, and no EPSS score is available. It is not listed in the CISA KEV catalog. An unauthenticated attacker with network access can exploit the flaw by sending a crafted SIP message with an overlarge Content‑Length header. This attack is straightforward and does not require any authentication or special privileges, making it feasible for adversaries to inject malicious SIP commands that could compromise subsequent communication channels or subvert access controls.