CVE-2026-45084: OpenSIPS Presence Module DoS Vulnerability

CVE-2026-45084 Overview

CVE-2026-45084 is a null pointer dereference vulnerability [CWE-476] in the OpenSIPS Session Initiation Protocol (SIP) server. The flaw resides in the presence module's handle_publish() function. It affects OpenSIPS versions 3.4.0 through 3.6.5 when enable_sphere_check=1 is configured. A remote attacker can crash an affected instance by sending a single SIP PUBLISH request over UDP or TCP. The vulnerable code path does not enforce authentication on its own. Maintainers addressed the issue in version 3.6.6 and 4.0.0-rc1.

Critical Impact
A single unauthenticated PUBLISH request can crash the OpenSIPS process, terminating SIP signaling for all connected users and disrupting VoIP services.

Affected Products

OpenSIPS 3.4.0 through 3.6.5 (presence module)
Deployments with enable_sphere_check=1 configured
SIP infrastructure exposing the presence route to untrusted networks

Discovery Timeline

2026-08-04 - CVE-2026-45084 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45084

Vulnerability Analysis

The presence module's handle_publish() function processes SIP PUBLISH requests carrying an Event: presence header and a message body. When enable_sphere_check=1 is set, the function invokes the get_content_type() macro to inspect the Content-Type of the payload. The macro assumes the Content-Type header has already been parsed. The code path skips the required call to parse_content_type_hdr() before dereferencing the parsing state.

Two crash conditions arise. When a Content-Type header is present but unparsed, msg->content_type->parsed is NULL yet the code dereferences it as a content_t pointer. When the request omits a Content-Type header entirely, msg->content_type itself is NULL and the dereference occurs at the outer pointer. Either case results in a segmentation fault that terminates the OpenSIPS process.

Root Cause

The root cause is a missing parser initialization step. The handle_publish() function calls get_content_type() without first ensuring the Content-Type header has been parsed through parse_content_type_hdr(). This violates the contract expected by the macro, leaving the parsed content state uninitialized or absent.

Attack Vector

An attacker sends a single SIP PUBLISH request to the OpenSIPS server over UDP or TCP. The request must include an Event: presence header. The attacker can either include a valid Content-Type: application/pidf+xml header without triggering full parsing, or omit the Content-Type header entirely. Both variants reach the vulnerable dereference. The vulnerable code itself performs no authentication check, though deployment routing scripts may impose authentication before the presence route is reached.

Detection Methods for CVE-2026-45084

Indicators of Compromise

Unexpected termination or restart of the OpenSIPS process shortly after receiving a SIP PUBLISH request
Core dumps or segmentation fault entries in system logs referencing the OpenSIPS binary and the presence module
Inbound SIP PUBLISH traffic containing Event: presence from unknown or untrusted sources
Requests missing a Content-Type header while carrying a message body targeting the presence service

Detection Strategies

Monitor OpenSIPS service availability with health checks that alert on unexpected process exits or crash loops
Inspect SIP traffic at the network edge for anomalous PUBLISH requests with Event: presence from non-subscriber addresses
Correlate operating system crash events with preceding SIP request logs to identify the triggering payload
Enable verbose SIP transaction logging on the presence route to capture malformed or unauthenticated PUBLISH requests

Monitoring Recommendations

Track process uptime and restart frequency for the OpenSIPS service through the host monitoring stack
Alert on SIP PUBLISH request rate spikes from single source IPs targeting the presence module
Ingest OpenSIPS syslog output and crash reports into centralized logging for correlation and retention
Baseline legitimate presence subscribers to identify unexpected sources sending PUBLISH messages

How to Mitigate CVE-2026-45084

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 where the missing parse_content_type_hdr() call has been added
Restrict inbound SIP traffic to trusted networks and authenticated subscribers using firewall rules or a SIP-aware access control layer
Require authentication in the routing script before requests reach the presence handler
Review OpenSIPS configuration for enable_sphere_check=1 and evaluate whether the setting is required

Patch Information

The OpenSIPS project released fixed builds in version 3.6.6 and 4.0.0-rc1. The patch introduces the required call to parse_content_type_hdr() before get_content_type() is invoked inside handle_publish(), ensuring the parsing state is initialized before dereference. Details are available in the OpenSIPS GitHub Security Advisory GHSA-h3ww-hchh-x2g9.

Workarounds

Set enable_sphere_check=0 in the presence module configuration to avoid the vulnerable code path until patching is complete
Enforce SIP digest authentication on the routing script path leading to the presence route
Deploy a SIP-aware reverse proxy or session border controller to drop PUBLISH requests missing a Content-Type header or originating from untrusted sources
Rate-limit inbound PUBLISH requests per source address to reduce blast radius during exploitation attempts

bash

# Example: disable the vulnerable sphere check in opensips.cfg
modparam("presence", "enable_sphere_check", 0)