Description
SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
Published: 2026-09-13
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service (process crash potentially leading to service disruption)
Action: Patch Immediately
AI Analysis

Impact

SIPp versions through 3.7.7 contain a buffer overflow in the get_peer_tag() function that processes SIP To header tag values. When an attacker sends a SIP message with a tag parameter that is 2049 bytes or longer, the static buffer is exceeded, causing the SIPp process to crash. The overflow does not immediately grant executable code but can be used for denial-of-service attacks to bring the service down.

Affected Systems

The affected vendor is SIPp. The product is SIPp distributed from the official SIPp project. Versions up to and including 3.7.7 are vulnerable; later releases contain the fix.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, but the KEV status shows it is not listed as a known exploited vulnerability. The attack vector is remote; an unauthenticated attacker can trigger the overflow by sending crafted SIP messages from an external network. Exploit requirements are minimal: access to the SIP interface used by SIPp. Given the high CVSS and the potential for widespread denial of service, this vulnerability poses a significant risk to services using an unpatched SIPp installation.

Generated by OpenCVE AI on September 13, 2026 at 17:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SIPp to a version newer than 3.7.7 that contains the buffer overflow fix.
  • If an upgrade is not immediately feasible, apply the patch from commit ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4 to the source, build the binaries, and redeploy.
  • Configure SIPp or upstream firewall to reject SIP messages with To header tag parameters longer than 2048 bytes to prevent the overflow from being triggered during the parsing stage.

Generated by OpenCVE AI on September 13, 2026 at 17:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
Title SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
Weaknesses CWE-120
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-13T11:42:27.756Z

Reserved: 2026-09-13T11:15:50.569Z

Link: CVE-2026-90778

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-13T12:17:16.837

Modified: 2026-09-13T12:17:16.837

Link: CVE-2026-90778

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T17:15:06Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')