CVE-2026-45537: OpenSIPS Buffer Overflow Vulnerability

CVE-2026-45537 Overview

CVE-2026-45537 is a critical buffer overflow vulnerability [CWE-120] in OpenSIPS, an open-source Session Initiation Protocol (SIP) server implementation used in telecommunications infrastructure. The flaw resides in the construct_uri() function, which concatenates URI components into a fixed 1024-byte global BSS buffer without bounds checking. A remote unauthenticated attacker can send a SIP message with a long username to overflow the buffer and corrupt adjacent global variables, including disable_503_translation. The vulnerability affects OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1.

Critical Impact
Remote unauthenticated attackers can corrupt global server state and alter SIP routing behavior by sending crafted URI usernames, undermining the integrity and availability of OpenSIPS deployments.

Affected Products

OpenSIPS versions prior to 3.6.6
OpenSIPS versions prior to 4.0.0-rc1
SIP server deployments using routing scripts that invoke construct_uri()

Discovery Timeline

2026-08-04 - CVE-2026-45537 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45537

Vulnerability Analysis

The construct_uri() function in OpenSIPS assembles a SIP Uniform Resource Identifier (URI) by concatenating protocol, username, domain, port, and parameter components into a global buffer of fixed 1024-byte size located in the BSS segment. The function performs no length validation on the combined size of the input components before writing to the destination.

When a routing script calls construct_uri() with an attacker-controlled username, exceeding the buffer's capacity overflows into adjacent global variables. The overflow reaches disable_503_translation, a global flag that controls how the server handles SIP 503 (Service Unavailable) responses. Attackers can deterministically set this flag through crafted URI usernames.

The same buffer is also shared with contact_builder(), so the overflow silently corrupts data used by that function on every request containing an oversized username. Without a memory sanitizer, these overwrites occur without visible crashes.

Root Cause

The root cause is missing bounds enforcement on input-derived lengths when writing to a fixed-size global buffer. The concatenation logic assumes attacker-influenced fields such as the SIP username are constrained upstream, but no such guarantee exists.

Attack Vector

Exploitation requires only network access to a vulnerable OpenSIPS instance. An attacker sends a SIP request containing a URI with a username field long enough to overflow the 1024-byte buffer, embedding controlled bytes at the offset corresponding to disable_503_translation. Subsequent SIP messages are routed according to the corrupted flag state.

// Patch excerpt: modules/sipmsgops/sipmsgops.c
// Enforces bounds check on header name length before memcpy
for (it=msg->headers;it;it=it->next) {
	if (it->name.len >= sizeof(hdr_name_buf)) {
		LM_WARN("header name too long (%d), skipping\n", it->name.len);
		continue;
	}
	memcpy(hdr_name_buf,it->name.s,it->name.len);
	hdr_name_buf[it->name.len] = 0;

Source: OpenSIPS commit 5f103ef

Detection Methods for CVE-2026-45537

Indicators of Compromise

SIP INVITE, REGISTER, or other request messages containing URI username fields exceeding several hundred bytes.
Unexpected changes in SIP 503 response handling behavior, such as suppression of 503 translation on the OpenSIPS server.
Anomalous routing decisions applied to sessions after receiving abnormally long URIs.
OpenSIPS process crashes or memory corruption warnings in logs when compiled with a memory sanitizer.

Detection Strategies

Inspect SIP traffic at network boundaries for URI usernames exceeding RFC-recommended lengths, flagging any component near or above 1024 bytes.
Enable AddressSanitizer or equivalent memory sanitizers in test environments to surface the overflow deterministically.
Correlate SIP transaction logs to identify state changes in disable_503_translation behavior that persist across sessions.

Monitoring Recommendations

Log full SIP request lines and From/To/Contact headers on OpenSIPS front-ends to enable retrospective analysis of oversized URIs.
Alert on sudden shifts in the ratio of 503 responses issued or translated by the server.
Monitor OpenSIPS binary version and build metadata across the fleet to identify unpatched hosts.

How to Mitigate CVE-2026-45537

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later, which apply bounds checks on input-derived lengths.
Audit routing scripts for calls to construct_uri() that pass attacker-controlled URI components, particularly $fU, $rU, and $tU username variables.
Restrict network exposure of SIP signaling interfaces to trusted peers where feasible.

Patch Information

The issue is fixed in OpenSIPS 3.6.6 and 4.0.0-rc1. Reference the GitHub Security Advisory GHSA-v7h4-fwrc-c66v, the primary fix commit 4d23613, and the follow-up commit 5f103ef.

Workarounds

If patching cannot be performed immediately, validate URI username length in routing scripts before invoking construct_uri() and reject requests with excessively long components.
Deploy a Session Border Controller (SBC) or upstream SIP proxy that enforces strict URI length limits on inbound traffic.
Restrict SIP signaling access using firewall rules to authenticated peers or known networks.

bash

# Example OpenSIPS routing script guard: reject overly long usernames
if ($(fU{s.len}) > 128) {
    xlog("L_WARN", "Rejecting SIP request with oversized username length=$(fU{s.len})\n");
    sl_send_reply(400, "Bad Request");
    exit;
}