CVE-2026-90778: SIPp Buffer Overflow Vulnerability

CVE-2026-90778 Overview

CVE-2026-90778 is a buffer overflow vulnerability in SIPp, an open-source Session Initiation Protocol (SIP) testing tool. Versions through 3.7.7 fail to bound the copy operation inside the get_peer_tag() function when parsing the tag parameter of a SIP To header. An unauthenticated remote attacker can send a crafted SIP message containing a tag parameter of 2049 bytes or more to overflow a static stack buffer and crash the SIPp process. The flaw is tracked under CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact
Unauthenticated remote attackers can crash SIPp instances over the network by sending a single oversized SIP To header tag, disrupting SIP testing, load generation, and any production workflows that depend on SIPp.

Affected Products

SIPp versions up to and including 3.7.7
Any deployment consuming SIP traffic through the vulnerable sip_parser.cpp code path
Automated testing and CI pipelines that expose SIPp to untrusted SIP peers

Discovery Timeline

2026-09-13 - CVE-2026-90778 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90778

Vulnerability Analysis

The vulnerability resides in the get_peer_tag() function inside src/sip_parser.cpp of the SIPp source tree. The function extracts the value of the tag parameter from a SIP To header and copies it byte-by-byte into a fixed-size static buffer named tag. The original loop terminates only on whitespace, semicolon, carriage return, or newline characters — it never validates the destination buffer size. When the incoming tag parameter reaches 2049 bytes or more, the write overruns the allocated buffer, corrupting adjacent memory and causing the SIPp process to crash.

Because SIPp typically runs as a network-facing SIP endpoint during testing, the vulnerable code path is reachable by any peer that can transmit SIP messages to the listening socket. No authentication is required, and the attacker only needs to send a single malformed SIP request or response.

Root Cause

The root cause is a missing bounds check during a manual while-loop copy. The parser trusts network-supplied input length while writing into a stack-allocated buffer of fixed size. This is a textbook [CWE-120] classic buffer overflow — the size of the source data is never compared against the size of the destination.

Attack Vector

An attacker sends a SIP message (for example, INVITE, BYE, or a response) whose To header contains a tag parameter with 2049 or more non-delimiter bytes. When SIPp parses the header, get_peer_tag() writes past the end of the tag buffer, resulting in process termination. Repeated messages produce a sustained denial-of-service condition against the SIPp instance.

cpp

     }
 
     while (*ptr && *ptr != ' ' && *ptr != ';' && *ptr != '\t' &&
-           *ptr != '\r' && *ptr != '\n') {
+           *ptr != '\r' && *ptr != '\n' && tag_i < (int) sizeof(tag) - 1) {
         tag[tag_i++] = *(ptr++);
     }
     tag[tag_i] = '\0';
// Source: https://github.com/SIPp/sipp/commit/ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4
// The patch adds `tag_i < (int) sizeof(tag) - 1` to the loop condition,
// ensuring the copy cannot exceed the destination buffer.

Detection Methods for CVE-2026-90778

Indicators of Compromise

Unexpected SIPp process crashes or restarts on hosts running SIP testing workloads
SIP messages captured on the wire with a To header tag parameter exceeding 2048 bytes
Core dumps or segmentation fault entries referencing get_peer_tag or sip_parser.cpp
Sudden termination of long-running SIPp scenarios without a graceful shutdown log entry

Detection Strategies

Inspect SIP traffic at the network layer for abnormally long tag= values in To and From headers
Enable core dumps on SIPp hosts and alert on crashes whose backtrace includes get_peer_tag()
Monitor process lifecycle telemetry for repeated SIPp exits with signals such as SIGSEGV or SIGABRT
Compare deployed SIPp binary versions against the fixed release to identify unpatched hosts

Monitoring Recommendations

Log and alert on SIP packets larger than expected baselines for your test environment
Correlate SIPp crash events with source IPs and SIP header contents captured at the perimeter
Track host-level metrics for SIPp CPU, memory, and restart frequency to catch DoS attempts early

How to Mitigate CVE-2026-90778

Immediate Actions Required

Upgrade SIPp to a build that includes commit ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4 from SIPp PR #879
Restrict SIPp listeners to trusted networks and management VLANs using host or network firewall rules
Audit CI/CD and lab environments for exposed SIPp instances reachable from untrusted networks
Review the VulnCheck advisory on SIPp for additional context

Patch Information

The upstream fix bounds the copy loop in get_peer_tag() against sizeof(tag) - 1, preventing writes beyond the destination buffer. The patch is available in the SIPp GitHub repository via commit ddf22d1 and the vulnerable code path is documented in src/sip_parser.cpp. Rebuild SIPp from source after applying the fix or upgrade to any release that includes it.

Workarounds

Place SIPp behind a SIP-aware proxy or session border controller that enforces header size limits
Use ingress firewall rules to accept SIP traffic only from known test peers
Run SIPp inside a sandbox or container with automatic restart, minimizing DoS impact until patched
Filter inbound SIP messages whose To header exceeds a reasonable maximum length (for example, 1024 bytes)

bash

# Build the patched SIPp from source
git clone https://github.com/SIPp/sipp.git
cd sipp
git checkout ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4
cmake . && make

# Restrict SIPp exposure with iptables (example: allow only 10.0.0.0/24)
iptables -A INPUT -p udp --dport 5060 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j DROP