A session‑initiated protocol server suffers a denial of service when a SIP request contains a corrupted bandwidth line in its SDP body. The missing colon delimiter corrupts internal bandwidth metadata, and subsequent cloning of this corrupted state during dialog or QoS processing terminates the worker process. The owner of the affected server can be completely disrupted by any one well‑formed SIP packet. The weakness is an uncontrolled input that leads to a memory corruption and a crash, corresponding to CWE‑20 and CWE‑476.

All OpenSIPS servers running a version earlier than 3.6.6 or 4.0.0‑rc1 are susceptible. The issue is addressed in releases 3.6.6 and 4.0.0‑rc1 and later. Any environment that parses attacker‑controlled SDP content and applies dialog or QoS modules is at risk.

The CVSS score of 8.7 categorizes this vulnerability as high severity. Because no EPSS score is available, the probability of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an unauthenticated attacker may trigger the crash simply by sending a malformed SIP packet over the network. The impact would be a denial of service to the entire OpenSIPS process, affecting all ongoing or future SIP sessions.