CVE-2026-90778

SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

Published Sep 13, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

Analysis

Technical impact

SIPp versions up to 3.7.7 contain a buffer overflow in the get_peer_tag() function when parsing SIP To headers whose tag parameters are 2049 bytes or longer. This overflow does not grant code execution but triggers a crash of the SIPp process, resulting in service interruption. The flaw is a classic CWE-120 "Buffer Copy without Length Checks" vulnerability.

Affected Systems

Vulnerable versions include SIPp 3.7.7 and all earlier releases. The offending code resides in the official SIPp distribution and is fixed in subsequent releases.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can remotely trigger the overflow by sending a SIP message with an oversized tag parameter to the SIP interface used by SIPp. No elevated privileges or special configuration are required, so the risk of denial‑of‑service attacks remains significant for unpatched deployments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SIPp

sipp

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.7.7

No data.

Vendor Product Versions

Sipp

Version	Status	Scheme	Platform
`[0,3.7.7]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a SIPp release newer than 3.7.7 to apply the buffer overflow fix.
If an immediate upgrade is not feasible, apply the patch from commit ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4, rebuild, and redeploy.
Configure SIPp or the upstream firewall to reject To header tag parameters longer than 2048 bytes to prevent the overflow from being triggered during parsing.

Generated by OpenCVE AI on September 15, 2026 at 16:54 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.857% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/SIPp/sipp
https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L76-L113
https://github.com/SIPp/sipp/commit/ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4
https://github.com/SIPp/sipp/pull/879
https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-sip-to-header-tag

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 13, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sipp Sipp sipp
Vendors & Products		Sipp Sipp sipp

Sep 13, 2026 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
Title		SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
Weaknesses		CWE-120
References		https://github.com/SIPp/sipp https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L76-L113 https://github.com/SIPp/sipp/commit/ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4 https://github.com/SIPp/sipp/pull/879 https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-sip-to-header-tag
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`