CVE-2026-45538— OpenSIPS 缓冲区错误漏洞

OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

栈缓冲区溢出

OpenSIPS 缓冲区错误漏洞

OpenSIPS是OpenSIPS组织开源的一个 GPL 许可的 SIP 服务器实现。 OpenSIPS 4.0.0及之前版本存在缓冲区错误漏洞，该漏洞源于sip_to_json()函数在处理SIP消息时未进行边界检查，将超过255字节的头部名称复制到固定栈缓冲区，导致栈缓冲区溢出，可能允许未经身份验证的攻击者通过单个UDP数据包导致进程崩溃或远程代码执行。

N/A

N/A