The vulnerability is a global buffer overflow in the construct_uri() function of OpenSIPS. When a SIP routing script passes a username that together with other URI components exceeds 1024 bytes, the function writes beyond the fixed buffer and corrupts adjacent global data. The overflow can deterministically set the disable_503_translation flag, thereby altering the server’s handling of SIP 503 responses and the routing of subsequent messages. The same buffer is also shared with contact_builder(), so repeated requests with a long username further corrupt that function’s data, potentially leading to service disruption and unauthorized routing.

OpenSIPS implementations prior to version 3.6.6 and the 4.0.0‑rc1 release candidate are affected. Those releases employ a fixed 1024‑byte global buffer for URI construction without bounds checking, making them vulnerable to the overflow.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score is not available, and it is not listed in CISA KEV. The attack vector is remote, as the overflow occurs during the processing of external SIP requests. An attacker can craft a username long enough to overflow the buffer and manipulate global state, leading to deterministic changes in routing behavior or denial of service. Because the corruption persists across requests and memory sanitizers are absent, the exploitation likelihood is high in environments where the vulnerable OpenSIPS instance processes untrusted SIP traffic.