CVE-2026-45705: OpenSIPS Buffer Overflow Vulnerability

CVE-2026-45705 Overview

CVE-2026-45705 is an out-of-bounds read vulnerability [CWE-125] in OpenSIPS, a widely deployed Session Initiation Protocol (SIP) server. The flaw resides in the find_line_delimiter() function within the multipart body parser. When parsing a SIP message with Content-Type: multipart/mixed, the function performs a strncmp() comparison that reads past the end of the message body buffer. The bug affects OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. Successful triggering results in memory disclosure or availability impact on the SIP server.

Critical Impact
Remote, unauthenticated attackers can send crafted SIP multipart messages that cause the parser to read memory beyond the body buffer, potentially triggering a denial-of-service condition on OpenSIPS servers.

Affected Products

OpenSIPS versions prior to 3.6.6
OpenSIPS 4.0.0 release candidates prior to 4.0.0-rc1
Deployments processing SIP messages with multipart/mixed bodies

Discovery Timeline

2026-08-05 - CVE-2026-45705 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45705

Vulnerability Analysis

The vulnerability lives in find_line_delimiter(), a helper used by OpenSIPS to locate MIME boundary markers inside multipart SIP bodies. The function scans for a -- sequence, then uses strncmp() to verify the boundary string follows. The comparison reads delimiter.len bytes, typically between 20 and 70, starting from an offset at or beyond the end of the body buffer. When a -- pattern lands within two to three bytes of the body's end, the function reads past that boundary. The read touches adjacent heap memory that may contain sensitive data or unmapped pages.

Root Cause

The parser does not validate that delimiter.len bytes remain available in the body buffer before invoking strncmp(). Input-derived lengths flow into memory comparison routines without bounds enforcement. The upstream fix, applied in commits 4d23613b and 5f103eff, adds bounds checks on lengths derived from untrusted SIP input across the core translator and sipmsgops module.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a single SIP message to a reachable OpenSIPS instance with Content-Type: multipart/mixed, a boundary parameter, and a body ending with a -- sequence positioned two to three bytes before the buffer terminus without a matching boundary string. The parser then reads out-of-bounds memory. Because SIP is commonly exposed on UDP port 5060 to the internet or to carrier networks, exposure is high.

// Patch excerpt: modules/sipmsgops/sipmsgops.c
// Enforces bounds check on header name length before memcpy
	for (it=msg->headers;it;it=it->next) {
+		if (it->name.len >= sizeof(hdr_name_buf)) {
+			LM_WARN("header name too long (%d), skipping\n", it->name.len);
+			continue;
+		}
 		memcpy(hdr_name_buf,it->name.s,it->name.len);
 		hdr_name_buf[it->name.len] = 0;
// Source: [OpenSIPS commit 4d23613b](https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb)

Detection Methods for CVE-2026-45705

Indicators of Compromise

Inbound SIP messages containing Content-Type: multipart/mixed with unusually short bodies terminated by -- without a valid trailing boundary token.
OpenSIPS process crashes, segmentation faults, or restarts correlated with SIP traffic from a single source.
Elevated rates of malformed SIP requests logged by OpenSIPS with parser warnings referencing multipart body handling.

Detection Strategies

Deploy SIP-aware intrusion detection signatures that flag multipart/mixed bodies where the trailing -- sequence is not followed by the declared boundary string.
Correlate OpenSIPS worker crash events with source IP addresses in SIP proxy logs to identify probing activity.
Monitor for anomalous body-length distributions in inbound SIP INVITE and MESSAGE requests carrying multipart content.

Monitoring Recommendations

Ingest OpenSIPS logs and SIP traffic metadata into a centralized analytics platform for pattern analysis.
Track process stability metrics for opensips workers and alert on abnormal restart cadence.
Enable core dump collection on OpenSIPS hosts to support forensic analysis if crashes occur.

How to Mitigate CVE-2026-45705

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later on all production and edge SIP nodes.
Restrict SIP signaling exposure to trusted peers using firewall rules or SIP border controllers where feasible.
Enable rate limiting on inbound SIP traffic to reduce impact from repeated malformed message probing.

Patch Information

The OpenSIPS project addressed the flaw in commits 4d23613b and 5f103eff. The fixes enforce bounds checks on lengths derived from input data across the core translator and sipmsgops module. Full details are available in the OpenSIPS GHSA-chxf-9368-fqcp advisory.

Workarounds

Disable modules that process multipart/mixed bodies if they are not required for the deployment.
Deploy a SIP-aware proxy or session border controller in front of OpenSIPS to strip or reject malformed multipart bodies.
Apply topology hiding and access control lists to limit which peers can send SIP requests to the server.

bash

# Verify installed OpenSIPS version and upgrade path
opensips -V

# Debian/Ubuntu upgrade example after adding the OpenSIPS 3.6.x repository
sudo apt update
sudo apt install --only-upgrade opensips

# Restart the service after upgrade
sudo systemctl restart opensips
sudo systemctl status opensips