Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
Published: 2026-08-04
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenSIPS versions 4.0.0 and prior contain a stack buffer overflow in the sip_to_json() function. When the function copies a SIP header name longer than 255 bytes into a fixed 255‑byte buffer without bounds checking, an attacker can craft a SIP message whose header name exceeds the limit. The overflow corrupts the saved frame pointer and return address, allowing the attacker to crash the process or, on builds without stack protections, hijack execution to achieve remote code execution.

Affected Systems

All deployments of OpenSIPS:opensips running version 4.0.0 or earlier that use the sip_to_json() function within their routing scripts are affected. The vulnerability is triggered by any routing script that calls this function with untrusted SIP header names.

Risk and Exploitability

The vulnerability receives a CVSS score of 9.8, indicating critical severity. EPSS is not available and the issue is not listed in CISA’s KEV catalog. A single unauthenticated UDP packet sent to the SIP port (5060) can trigger the overflow, meaning the attack vector is readily exploitable and requires no special privileges. On systems without stack protection such as stack canaries, this overflow can lead to arbitrary code execution, making the risk extremely high.

Generated by OpenCVE AI on August 4, 2026 at 22:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenSIPS to a version that contains the fix or to a newer major release where the issue is resolved.
  • If upgrading is not an option, modify routing scripts to eliminate or replace the use of sip_to_json() when processing headers that might exceed 255 bytes, or patch the function to enforce a length check before copying.
  • Recompile OpenSIPS with stack protection (e.g., enable -fstack-protector-strong or similar compiler options) to mitigate the impact of any remaining overflows.

Generated by OpenCVE AI on August 4, 2026 at 22:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Opensips
Opensips opensips
Vendors & Products Opensips
Opensips opensips

Tue, 04 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
Title OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Opensips Opensips
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-04T20:47:10.262Z

Reserved: 2026-05-12T17:48:47.878Z

Link: CVE-2026-45538

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T22:45:03Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow