CVE-2026-45538: OpenSIPS SIP Server RCE Vulnerability

CVE-2026-45538 Overview

CVE-2026-45538 is a stack buffer overflow [CWE-121] in OpenSIPS, an open-source Session Initiation Protocol (SIP) server. The flaw resides in the sip_to_json() function inside modules/sipmsgops/sipmsgops.c. When a routing script invokes sip_to_json(), the function copies a SIP header name into a fixed 255-byte stack buffer using memcpy without validating the source length. Because the SIP parser permits header names up to roughly 65,000 bytes, a single unauthenticated UDP packet sent to port 5060 can corrupt the saved frame pointer and return address. Versions 4.0.0 and prior are affected, and no fix was available at publication.

Critical Impact
A single unauthenticated UDP packet can crash the OpenSIPS process or, on builds without stack protections, achieve remote code execution.

Affected Products

OpenSIPS 4.0.0 and prior versions
Deployments whose routing script invokes sip_to_json()
SIP infrastructure exposing UDP port 5060 to untrusted networks

Discovery Timeline

2026-08-04 - CVE-2026-45538 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45538

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow triggered during SIP message processing. OpenSIPS exposes the sip_to_json() helper to routing scripts, which converts SIP header structures into a JSON representation. Inside the function, the code declares a 255-byte automatic array on the stack for the header name. It then issues a memcpy using the header name length reported by the SIP parser as the copy size. The parser accepts header names substantially longer than 255 bytes, so the copy proceeds past the end of the destination buffer and into the saved frame pointer and return address slots.

Both the length and the content of the overwrite are attacker-controlled. On builds compiled without stack canaries or with predictable memory layouts, an attacker can pivot execution to attacker-supplied bytes, resulting in unauthenticated remote code execution. On hardened builds, the process crashes and denial of service follows.

Root Cause

The root cause is missing bounds checking before a memcpy into a fixed-size stack buffer. The developer assumed the SIP parser would constrain header-name length, but no such constraint exists at the parsing layer. This assumption mismatch between parser and consumer creates the overflow condition.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a crafted SIP message (typically INVITE or REGISTER) over UDP to port 5060. The message contains a single header whose name field exceeds 255 bytes and encodes attacker-chosen bytes at the position of the saved return address. When the OpenSIPS routing script calls sip_to_json() on that message, the overflow triggers.

The vulnerability manifests when sip_to_json() executes
memcpy(stack_buffer_255, header_name_ptr, header_name_len)
without validating header_name_len against 255.
See the OpenSIPS GHSA-37wc-5j8j-95x3 advisory for details.

Detection Methods for CVE-2026-45538

Indicators of Compromise

SIP messages received on UDP/5060 containing header names longer than 255 bytes
Unexpected OpenSIPS process crashes, segmentation faults, or restarts in syslog or systemd journal
Core dumps from the opensips binary referencing sip_to_json or sipmsgops.so in the crash frame
Outbound network connections initiated by the opensips process to unusual destinations following a crash

Detection Strategies

Deploy SIP-aware intrusion detection signatures that flag any header name exceeding 255 bytes
Inspect packet captures on UDP/5060 for oversized header tokens preceding a colon delimiter
Correlate OpenSIPS process termination events with inbound SIP traffic bursts in the preceding seconds
Monitor for anomalous child processes or shell invocations spawned by the opensips parent process

Monitoring Recommendations

Enable verbose SIP message logging in staging environments to baseline normal header sizes
Ship OpenSIPS logs and host telemetry to a centralized data lake for correlation across SIP frontends
Alert on repeated crash-restart cycles of the OpenSIPS service, which indicate probing or exploitation attempts
Track network egress from SIP servers to identify post-exploitation callback traffic

How to Mitigate CVE-2026-45538

Immediate Actions Required

Audit routing scripts for calls to sip_to_json() and remove or gate them until a patch is available
Restrict UDP/5060 access at the network edge to trusted SIP peers using firewall or session border controller rules
Enable compiler hardening (stack canaries, ASLR, non-executable stack) on all OpenSIPS builds
Deploy a SIP-aware reverse proxy that rejects header names longer than a safe threshold (for example, 256 bytes)

Patch Information

At the time of NVD publication, no upstream fix was available. Monitor the OpenSIPS GitHub Security Advisory GHSA-37wc-5j8j-95x3 for patch releases. Track the OpenSIPS project release notes for a version above 4.0.0 that addresses the sip_to_json() boundary check.

Workarounds

Remove all sip_to_json() invocations from the OpenSIPS routing script and reload the configuration
Front OpenSIPS with a SIP-aware proxy or session border controller that enforces RFC 3261 header-length sanity limits
Apply operating system firewall rules (iptables, nftables) to restrict SIP traffic to known peers
Run OpenSIPS under a supervisor with rapid restart and rate limiting to blunt denial-of-service attempts

bash

# Example nftables rule limiting UDP/5060 to a trusted peer subnet
nft add rule inet filter input udp dport 5060 ip saddr != 203.0.113.0/24 drop

# Example: comment out sip_to_json() calls in opensips.cfg
# $var(json) = sip_to_json();   # disabled pending CVE-2026-45538 patch