CVE-2026-45103: OpenSIPS Auth Bypass Vulnerability

CVE-2026-45103 Overview

CVE-2026-45103 is an integer overflow vulnerability [CWE-190] in OpenSIPS, an open-source Session Initiation Protocol (SIP) server. The flaw resides in the TCP message framing layer, which parses the Content-Length header using unsigned integer arithmetic without overflow checks. An attacker who sends a Content-Length value that wraps around (for example, 4294967296) forces the framing layer to split the TCP stream at the wrong boundary. This enables unauthenticated SIP message smuggling across any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss). Versions prior to 3.6.6 and 4.0.0-rc1 are affected.

Critical Impact
Unauthenticated network attackers can smuggle arbitrary SIP messages past front-end SBC/proxy security policies, inherit trusted authentication contexts, and evade rate limiting.

Affected Products

OpenSIPS versions prior to 3.6.6
OpenSIPS 4.0.0 pre-release versions prior to 4.0.0-rc1
Any OpenSIPS deployment with TCP-based transports enabled (proto_tcp, proto_tls, proto_ws, proto_wss)

Discovery Timeline

2026-08-04 - CVE-2026-45103 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45103

Vulnerability Analysis

The OpenSIPS TCP framing layer determines SIP message boundaries by reading the Content-Length header from the transport stream. The parser stores the value in an unsigned integer and performs arithmetic without validating the input range. When an attacker supplies a value such as 4294967296, the unsigned integer wraps to 0, and the framing logic treats the message body as the start of a new, separate SIP message.

Because Content-Length parsing occurs before authentication, no routing-script preconditions or credentials are required. The smuggled message inherits the TCP connection's existing authentication context. This allows attackers to bypass Session Border Controller (SBC) and proxy security policies, evade rate limiting, and inject arbitrary SIP requests (REGISTER, INVITE, MESSAGE) into trusted internal paths.

Root Cause

The root cause is a classic integer overflow [CWE-190] in transport-layer header parsing. The Content-Length field is accepted as an unsigned 32-bit integer with no upper-bound validation. An attacker-controlled value that exceeds UINT_MAX wraps modulo 2^32, producing a small or zero-valued length that misaligns the message framing state machine.

Attack Vector

An unauthenticated remote attacker opens a TCP, TLS, WebSocket, or Secure WebSocket connection to the OpenSIPS server. The attacker sends a SIP request containing a crafted Content-Length header (such as Content-Length: 4294967296) followed by a body containing a second, hidden SIP message. The framing layer, computing a wrapped length, closes the first message prematurely and parses the smuggled payload as an independent, trusted message.

// Security patch excerpt: modules/sipmsgops/sipmsgops.c
// Enforce bounds checks on input-derived lengths (#3888)
	for (it=msg->headers;it;it=it->next) {
+		if (it->name.len >= sizeof(hdr_name_buf)) {
+			LM_WARN("header name too long (%d), skipping\n", it->name.len);
+			continue;
+		}
 		memcpy(hdr_name_buf,it->name.s,it->name.len);
 		hdr_name_buf[it->name.len] = 0;

Source: OpenSIPS commit 4d23613b

Detection Methods for CVE-2026-45103

Indicators of Compromise

Inbound SIP requests over TCP/TLS/WS/WSS with Content-Length values approaching or exceeding UINT_MAX (4294967295).
Unexpected SIP methods (REGISTER, INVITE, SUBSCRIBE) originating from connections previously authenticated for a different user or endpoint.
SIP transactions that bypass rate-limit counters or SBC policy logs while appearing in OpenSIPS backend logs.

Detection Strategies

Inspect SIP traffic at the SBC or reverse proxy for numerically anomalous Content-Length header values and reject requests where the value exceeds a sane upper bound (e.g., 1 MB).
Correlate authenticated session identifiers with the message payloads processed per TCP connection to identify identity mismatches indicative of smuggling.
Enable verbose transport-layer logging in OpenSIPS to capture framing decisions and detect stream-splitting anomalies.

Monitoring Recommendations

Ingest OpenSIPS transport and transaction logs into a centralized SIEM and alert on multiple SIP requests reusing the same TCP connection with divergent From/Contact identities.
Track per-connection message counts and byte offsets; a mismatch between advertised Content-Length and actual body length is a strong indicator.
Monitor for spikes in REGISTER hijacking, toll-fraud INVITEs, or MESSAGE floods that correlate with anomalous TCP framing events.

How to Mitigate CVE-2026-45103

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 immediately across all production and edge nodes.
Audit all TCP-based SIP listeners (proto_tcp, proto_tls, proto_ws, proto_wss) and confirm patched binaries are running.
Review recent SIP transaction logs for anomalous Content-Length values and unexpected authenticated actions.

Patch Information

The issue is fixed in OpenSIPS 3.6.6 and 4.0.0-rc1. The upstream patches add bounds checks on input-derived lengths across the SIP parsing pipeline. See the OpenSIPS Security Advisory GHSA-jv35-555v-54jh and commits 4d23613b and 5f103eff for the code changes.

Workarounds

Place a hardened SBC or reverse proxy in front of OpenSIPS and configure it to reject SIP requests whose Content-Length exceeds a reasonable maximum (for example, 65535 bytes).
If patching is not immediately possible, disable TCP-based SIP transports and restrict clients to UDP where operationally feasible.
Restrict inbound SIP TCP/TLS access to allow-listed peer IP ranges to reduce the attack surface until patches are deployed.

bash

# Verify OpenSIPS version after upgrade
opensips -V

# Example: disable TCP listener in opensips.cfg until patched
# listen=tcp:0.0.0.0:5060   # comment out
# listen=tls:0.0.0.0:5061   # comment out
listen=udp:0.0.0.0:5060