The SIPGO library for Go contains a flaw in its stream parser where the body buffer for a SIP message is allocated based solely on the client supplied Content‑Length header before the maximum message size is checked. An attacker can send a TCP, TLS, WS, or WSS stream with an oversized declaration, causing the parser to reserve more memory than intended and resulting in a denial of service. Because the allocation occurs before authentication, the impact is a loss of availability for the running application without any user interaction.

The vulnerability affects the SIPGO library published by Emiago. Any deployment that uses a version of SIPGO prior to 1.4.1 is subject to the flaw. Versions 1.4.1 and later include the patch that enforces the maximum message length before memory allocation.

With a CVSS score of 7.5 this issue is classified as high severity. There is no EPSS data available and it is not listed in the CISA KEV catalog. The attack vector is unauthenticated network traffic; an adversary with access to the SIP transport can exploit the flaw by sending an oversized Content‑Length header during the initial stream parsing stage, achieving a denial of service without credentials.