Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Published: 2026-08-04
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow occurs when OpenSIPS copies an oversized watcher URI into a fixed-size buffer during watcherinfo XML generation. The flaw allows an attacker to crash the worker process, resulting in a denial of service. The vulnerability is triggered by a malformed SUBSCRIBE Event: presence request containing a long From URI.

Affected Systems

The affected vendor is OpenSIPS. Versions before 3.6.6 and before 4.0.0‑rc1 are vulnerable. The issue requires that both the presence and presence_xml modules be loaded and that SUBSCRIBE routing be reachable.

Risk and Exploitability

The CVSS score of 8.7 categorises the flaw as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending a crafted SIP SUBSCRIBE containing an excessively long From URI, causing the worker process to crash. In deployments where the presence modules are enabled, this leads to service disruption.

Generated by OpenCVE AI on August 5, 2026 at 00:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenSIPS to version 3.6.6 or later or 4.0.0‑rc1 or newer.
  • If an upgrade is not immediately possible, disable the presence_xml module to prevent watcherinfo XML generation.
  • Alternatively, disable SUBSCRIBE handling altogether or limit the length of the From URI in the SIP configuration to mitigate the overflow.

Generated by OpenCVE AI on August 5, 2026 at 00:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Title OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI
Weaknesses CWE-121
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-04T23:30:03.111Z

Reserved: 2026-05-13T08:19:32.604Z

Link: CVE-2026-45809

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T00:15:04Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow