CVE-2026-90779: SIPp Stack Buffer Overflow Vulnerability

CVE-2026-90779 Overview

CVE-2026-90779 is a stack buffer overflow vulnerability [CWE-121] affecting SIPp through version 3.7.7. The flaw resides in the createAuthHeader() function in src/auth.cpp, which processes Session Initiation Protocol (SIP) authentication challenges. When the function parses an oversized algorithm parameter from a 401 Unauthorized or 407 Proxy Authentication Required response, it writes past a fixed-size stack buffer. A malicious SIP server can send a crafted challenge to a connecting SIPp client and corrupt the stack, crashing the process.

Critical Impact
A remote, unauthenticated SIP server can trigger a stack buffer overflow in any SIPp client that initiates authenticated calls, resulting in process termination and denial of service.

Affected Products

SIPp versions up to and including 3.7.7
The createAuthHeader() routine in src/auth.cpp (lines 183–192)
Any test harness, load generator, or automation pipeline that uses SIPp against untrusted SIP endpoints

Discovery Timeline

2026-09-13 - CVE-2026-90779 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90779

Vulnerability Analysis

SIPp is an open-source SIP traffic generator widely used to load-test VoIP infrastructure. When SIPp receives a 401 or 407 challenge, it calls createAuthHeader() to build a Digest response header. The function parses several parameters from the challenge, including algorithm, realm, and nonce.

The algorithm value is copied into a fixed 32-byte stack buffer (char algo[32]) using unbounded string operations. Because the server-supplied algorithm string is not length-checked before being written to algo, an attacker can supply a value longer than 31 bytes to overflow the buffer and overwrite adjacent stack data, including return addresses and saved registers.

The vulnerability is reachable purely through the SIP protocol response, requires no authentication, and no user interaction on the SIPp client side beyond initiating a call flow that requests digest authentication.

Root Cause

The root cause is unsafe parsing of an untrusted protocol field into a fixed-size stack buffer without validating input length. The patched code replaces manual pointer arithmetic with getAuthParameter(), which enforces bounded copies into algo.

Attack Vector

An attacker operating or impersonating a SIP server responds to a SIPp REGISTER or INVITE with a 401 or 407 message containing a WWW-Authenticate or Proxy-Authenticate header. The header includes an algorithm= parameter with a payload exceeding 31 bytes. When SIPp processes the response, createAuthHeader() overflows the algo buffer.

cpp

// Security patch in src/auth.cpp
// fix: use getAuthParameter() for algorithm in createAuthHeader()
 {
 
     char algo[32] = "MD5";
-    char *start, *end;
+    char *start;
 
     if ((start = stristr(auth, "Digest")) == nullptr) {
         snprintf(result, result_len, "createAuthHeader: authentication must be digest");

Source: GitHub SIPp Commit 1d4a562

The patch removes the manual start/end pointer parsing that copied the algorithm value directly into algo[32] and delegates parsing to getAuthParameter(), which performs bounded reads.

Detection Methods for CVE-2026-90779

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT termination of SIPp processes shortly after receiving a SIP 401 or 407 response.
SIP WWW-Authenticate or Proxy-Authenticate headers containing an algorithm= value longer than 31 bytes.
Core dumps from SIPp with corrupted stack frames near createAuthHeader symbols.
Outbound SIP sessions from test infrastructure to unknown or newly observed SIP servers.

Detection Strategies

Inspect SIP traffic for malformed Digest challenges with abnormally long algorithm parameters using network sensors or protocol-aware IDS rules.
Monitor SIPp process exit codes and crash telemetry in continuous integration and load-testing environments.
Correlate SIPp crashes with the remote SIP peer address to identify hostile or misconfigured servers.

Monitoring Recommendations

Enable core dump collection on hosts running SIPp and forward crash artifacts to a centralized SIEM for analysis.
Alert on new outbound SIP destinations from testing subnets that were not previously observed.
Track the installed SIPp version across build agents and container images to identify systems still on 3.7.7 or earlier.

How to Mitigate CVE-2026-90779

Immediate Actions Required

Upgrade SIPp to a build that includes commit 1d4a5622bea34d0b5cdff333e6b5734608e30af7 or later.
Restrict SIPp clients to trusted, controlled SIP servers within isolated test networks.
Remove or disable SIPp installations that are not actively required.

Patch Information

The fix is committed to the SIPp repository as 1d4a562 and merged via GitHub SIPp Pull Request 880. The change replaces manual parsing in createAuthHeader() with getAuthParameter(), enforcing a bounded copy into the 32-byte algo buffer. Rebuild SIPp from source at HEAD or install a distribution package that incorporates the commit. See the VulnCheck SIPp Advisory for advisory details and the GitHub SIPp Repository for source access.

Workarounds

Run SIPp only against SIP endpoints you fully control and never against arbitrary or internet-facing servers.
Segment SIPp test hosts on isolated network segments with egress filtering to allowlisted SIP peers.
Disable digest authentication in test scenarios where it is not required, avoiding the vulnerable createAuthHeader() code path.
Compile SIPp with stack protection flags such as -fstack-protector-strong and address sanitizers in non-production builds to detect exploitation attempts.

bash

# Rebuild SIPp from a patched source tree
git clone https://github.com/SIPp/sipp.git
cd sipp
git checkout 1d4a5622bea34d0b5cdff333e6b5734608e30af7
cmake -DCMAKE_C_FLAGS="-fstack-protector-strong" \
      -DCMAKE_CXX_FLAGS="-fstack-protector-strong" .
make -j"$(nproc)"