CVE-2026-45100: OpenSIPS Buffer Overflow Vulnerability

CVE-2026-45100 Overview

CVE-2026-45100 is a buffer overflow vulnerability in OpenSIPS, an open-source Session Initiation Protocol (SIP) server implementation. The flaw resides in the {s.b64encode} string transformation, which only validates that input fits within the 64 KB transformation buffer without accounting for base64 encoding's roughly 33% size expansion. Inputs between approximately 49,153 and 65,535 bytes produce output exceeding the buffer, overflowing it by up to 21,844 bytes into adjacent transformation buffers. A remote unauthenticated attacker can trigger the overflow by sending a SIP message with an oversized header when the routing script applies {s.b64encode} to attacker-controlled input.

Critical Impact
Unauthenticated remote attackers can corrupt adjacent memory used by chained SIP message transformations, enabling attacker-controlled data injection into subsequent processing stages and potential service compromise.

Affected Products

OpenSIPS versions 3.4.0-beta through 3.6.5
OpenSIPS version 4.0.0-beta
Deployments where routing scripts apply {s.b64encode} to attacker-controlled SIP input

Discovery Timeline

2026-08-04 - CVE-2026-45100 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45100

Vulnerability Analysis

OpenSIPS uses fixed 64 KB transformation buffers to hold intermediate results when SIP routing scripts chain string operations. The {s.b64encode} transformation encodes input data using base64, which expands output length by approximately 4/3 of the input length. The size check for this transformation validates only the input length against the 64 KB buffer, ignoring the encoding expansion.

When input length falls between roughly 49,153 and 65,535 bytes, the resulting base64 output exceeds 64 KB. The transformation writes up to 21,844 bytes past the buffer boundary. This classifies as a classic buffer overflow [CWE-120].

Because transformation buffers are laid out adjacently in memory and reused across chained transformations processing the same SIP message, the overflow writes attacker-controlled bytes directly into a neighboring buffer. Any later transformation reading that buffer operates on attacker-supplied data, corrupting integrity of downstream SIP message handling.

Root Cause

The root cause is missing bounds validation on encoded output length. The code checks input size against the destination buffer without applying the base64 expansion factor. Fixed-size adjacent buffers used for chained transformations amplify the impact by turning a linear overflow into cross-buffer data corruption.

Attack Vector

Exploitation requires sending a single SIP message containing a header value of approximately 50,000 bytes or more to a vulnerable OpenSIPS server. The attack only succeeds when the routing configuration applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's script logic. No authentication or user interaction is required.

// Security patch from modules/sipmsgops/sipmsgops.c
// core: enforce bounds checks on input-derived lengths (#3888)
	for (it=msg->headers;it;it=it->next) {
+		if (it->name.len >= sizeof(hdr_name_buf)) {
+			LM_WARN("header name too long (%d), skipping\n", it->name.len);
+			continue;
+		}
 		memcpy(hdr_name_buf,it->name.s,it->name.len);
 		hdr_name_buf[it->name.len] = 0;

Source: OpenSIPS Commit 4d23613b

The patch adds an explicit length check before memcpy, skipping oversized headers rather than blindly copying attacker-controlled data into a fixed buffer.

Detection Methods for CVE-2026-45100

Indicators of Compromise

Inbound SIP messages containing individual header values exceeding 49,000 bytes
OpenSIPS process crashes or unexpected restarts correlated with malformed SIP traffic
Anomalous transformation output in logs when routing scripts invoke {s.b64encode}
Unusual memory access patterns or corrupted variable values during SIP message processing

Detection Strategies

Inspect SIP traffic at the network perimeter for oversized headers, flagging messages with header values above 8 KB as anomalous for most legitimate deployments
Enable verbose logging on OpenSIPS routing scripts that apply {s.b64encode} and alert on transformation failures
Deploy runtime memory protection such as AddressSanitizer or hardened allocators in staging environments to surface overflow attempts
Review OpenSIPS routing scripts for any use of {s.b64encode} on values sourced from SIP headers, URIs, or bodies

Monitoring Recommendations

Correlate OpenSIPS crash telemetry with source IP addresses of preceding SIP traffic
Track process restart frequency and abnormal termination signals from the OpenSIPS service
Monitor SIP message size distributions and alert on outliers above typical operational baselines
Ingest OpenSIPS logs into a centralized SIEM for cross-referencing with network flow data

How to Mitigate CVE-2026-45100

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1, which contain the official fix
Audit routing scripts and disable or restrict any use of {s.b64encode} on attacker-controlled input until patching completes
Enforce SIP message size limits at upstream load balancers or session border controllers
Restrict OpenSIPS network exposure to trusted peers where operationally feasible

Patch Information

The issue is fixed in OpenSIPS 3.6.6 and 4.0.0-rc1. The fixes are delivered in commits 4d23613b and 5f103eff, which enforce bounds checks on input-derived lengths across affected code paths. Full details are documented in GitHub Security Advisory GHSA-35fr-6rv9-vp68.

Workarounds

Modify routing scripts to validate input length before invoking {s.b64encode}, rejecting values above roughly 48,000 bytes
Deploy a SIP-aware proxy or firewall rule that drops messages with oversized headers before they reach OpenSIPS
Remove {s.b64encode} calls on untrusted data and substitute alternate encoding logic where possible

bash

# Example: verify installed OpenSIPS version and upgrade
opensips -V

# On Debian/Ubuntu after adding the OpenSIPS 3.6 repository
apt-get update && apt-get install --only-upgrade opensips=3.6.6

# Restart service after upgrade
systemctl restart opensips