CVE-2026-46334: OpenSIPS SDP Parsing DoS Vulnerability

CVE-2026-46334 Overview

CVE-2026-46334 is a denial of service vulnerability in OpenSIPS, an open-source Session Initiation Protocol (SIP) server implementation used in VoIP and telecommunications infrastructure. The flaw resides in the Session Description Protocol (SDP) bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp containing a malformed session-level bandwidth line missing the required colon delimiter corrupts parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, the OpenSIPS worker process crashes. An unauthenticated remote attacker can trigger the crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog or QoS processing. The issue is fixed in versions 3.6.6 and 4.0.0-rc1.

Critical Impact
Unauthenticated remote attackers can crash OpenSIPS worker processes by sending a single SIP request with a malformed SDP bandwidth line, disrupting VoIP call routing and SIP service availability.

Affected Products

OpenSIPS versions prior to 3.6.6
OpenSIPS 4.0.0 pre-release versions prior to 4.0.0-rc1
Deployments with routing scripts performing dialog and QoS processing on attacker-controlled SDP

Discovery Timeline

2026-08-05 - CVE-2026-46334 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-46334

Vulnerability Analysis

The vulnerability is an input validation flaw [CWE-20] in the OpenSIPS SDP parser located in parser/sdp/sdp_helpr_funcs.c. SDP bandwidth lines follow the b=<bwtype>:<bandwidth> format defined in RFC 4566. The parser assumed the colon delimiter would always be present when locating a b= prefix in the SDP body. When a malformed bandwidth line omits the colon, the parser stores an unbounded or malformed bwtype value into the SDP metadata structure.

The corrupted state does not immediately crash the worker. The failure occurs later, when downstream modules such as the dialog and qos modules clone the SDP state during transaction processing. The clone operation dereferences the corrupted bandwidth metadata and terminates the worker process. Because SIP is typically exposed over UDP or TCP without authentication at the transport layer, any attacker who can reach the SIP listener can send the triggering request.

Root Cause

The root cause is missing validation of the colon delimiter in the b= line parser. The function used l_memmem to locate b= and then read a line into the bwtype output structure without confirming the presence of the : separator that terminates the bandwidth type field. Later parsing steps and clone routines trusted the resulting length and pointer values.

Attack Vector

An unauthenticated remote attacker sends a single SIP INVITE, UPDATE, or re-INVITE message with Content-Type: application/sdp and an SDP body containing a session-level bandwidth line such as b=AS without the required colon and value. OpenSIPS parses the body during script execution, and any subsequent SDP clone triggered by dialog tracking or QoS enforcement crashes the worker.

// Patch excerpt from parser/sdp/sdp_helpr_funcs.c
// Source: https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444
{
	char *cp, *cp1;
	int len;
	str bline;

	cp1 = NULL;
	for (cp = body->s; (len = body->s + body->len - cp) > 0;) {
		cp1 = (char*)l_memmem(cp, "b=", len, 2);
		if (cp1 == NULL || cp1 == body->s ||
				cp1[-1] == '\n' || cp1[-1] == '\r')
			break;
		cp = cp1 + 2;
	}
	if (cp1 == NULL)
		return -1;

	bline.s = cp1 + 2;
	bline.len = eat_line(bline.s, body->s + body->len - bline.s) - bline.s;
	trim_len(bline.len, bline.s, bline);

	cp = bline.s;
	len = bline.len;
	cp1 = (char*)l_memmem(cp, ":", len, 1);
	if (cp1 == NULL) {
		// Reject malformed bandwidth line
	}
}

The patch introduces a local bline staging variable and explicitly checks the return of l_memmem for the : delimiter, rejecting malformed bandwidth lines before they can corrupt the caller-supplied bwtype structure.

Detection Methods for CVE-2026-46334

Indicators of Compromise

Unexpected termination or restart of OpenSIPS worker processes recorded in syslog or the OpenSIPS log with signal 11 (SIGSEGV)
Inbound SIP requests containing SDP bodies with b= lines that do not include a : delimiter
Repeated short-lived SIP transactions from a single source followed by worker respawn events

Detection Strategies

Inspect SIP traffic at the network edge for SDP payloads and flag b= lines lacking a colon-separated bandwidth type and value
Correlate OpenSIPS worker crash events with recent SIP message payloads captured by sngrep, pcap, or a homer/SIP capture agent
Alert on repeated OpenSIPS process restart cycles within short time windows, which indicate an ongoing DoS attempt

Monitoring Recommendations

Enable core dump collection on OpenSIPS hosts to preserve evidence of parser crashes for forensic analysis
Ship OpenSIPS process supervisor logs (systemd, supervisord) to a centralized log platform and alert on abnormal restart counts
Monitor SIP transaction failure rates and 5xx response spikes that correlate with worker restarts

How to Mitigate CVE-2026-46334

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1, which contain the fix for the malformed bandwidth line handling
Restrict SIP listener exposure to trusted networks or peers using firewall rules where operationally feasible
Enable rate limiting on the SIP transport to slow automated crash attempts while patching is scheduled

Patch Information

The vulnerability is fixed in OpenSIPS 3.6.6 and 4.0.0-rc1. The upstream fixes are available in the GitHub Commit Fix and GitHub Commit Update. Full advisory details are published in the GitHub Security Advisory GHSA-rh36-mhpv-cx2r.

Workarounds

Modify the routing script to skip parse_sdp() or dialog/QoS operations on SIP messages from untrusted sources until upgrades are complete
Deploy a SIP-aware proxy or session border controller (SBC) in front of OpenSIPS to normalize or reject SDP bodies with malformed b= lines
Use ACLs on the SIP listener to restrict inbound requests to known trunking peers where the service does not need to be publicly reachable

bash

# Verify installed OpenSIPS version and upgrade path
opensips -V

# Example: install patched version from source
git clone https://github.com/OpenSIPS/opensips.git
cd opensips
git checkout 3.6.6
make all && sudo make install

# Restart the service after upgrading
sudo systemctl restart opensips
sudo systemctl status opensips