The vulnerability resides in the WebSocket handling code of the SIPGO library, where the maximum frame size is not bounded before reading a message header. An attacker can send a frame header with an excessively large payload size, causing the library to allocate an oversized buffer or trigger a makeslice panic. This results in a crash or out‑of‑memory condition in the server process, leading to a denial of service. The weakness is an unbounded memory allocation, classified as CWE‑789.

The issue affects the sipgo library from emiago. Versions prior to 1.4.3 are vulnerable; the fix appears in release 1.4.3 and later.

The CVSS score is 7.5, indicating a high severity. Exploitation requires only the ability to connect to the WebSocket or WSS endpoint, and no authentication is required. The EPSS score is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the straightforward nature of the attack and the lack of controls suggest a significant risk to exposed services.