CVE-2026-90780: SIPp Buffer Overflow Vulnerability

CVE-2026-90780 Overview

CVE-2026-90780 is a buffer overflow vulnerability in SIPp, an open-source Session Initiation Protocol (SIP) traffic generator and testing tool. Versions through 3.7.7 contain a flaw in the get_header() function located in src/sip_parser.cpp. The function writes to a static buffer without bounds checking when processing SIP message headers exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized header content to overflow the static buffer and crash the SIPp process. The weakness is classified under [CWE-120] (Classic Buffer Copy without Checking Size of Input).

Critical Impact
Remote unauthenticated attackers can crash SIPp processes by sending SIP messages with headers larger than 20,490 bytes, resulting in denial of service against SIP testing infrastructure.

Affected Products

SIPp versions through 3.7.7
src/sip_parser.cppget_header() function
SIP testing and load-generation deployments running vulnerable SIPp builds

Discovery Timeline

2026-09-13 - CVE-2026-90780 published to the National Vulnerability Database (NVD)
2026-09-20 - Last updated in NVD database

Technical Details for CVE-2026-90780

Vulnerability Analysis

SIPp parses inbound SIP messages using the get_header() function in src/sip_parser.cpp. The function copies header content into a static buffer named last_header, sized as MAX_HEADER_LEN * 10 (20,490 bytes). The original implementation does not track the end of this destination buffer during writes. When a SIP message carries header content larger than the destination buffer, write operations continue past the allocated region and corrupt adjacent memory. The corruption terminates the SIPp process and disrupts any active SIP test campaigns or call-flow validation running against telephony infrastructure.

Root Cause

The root cause is missing bounds enforcement on writes into a fixed-size static buffer. The get_header() routine iterates over parsed header data and writes into last_header without comparing the destination pointer to the buffer end. Attacker-controlled header length directly determines how many bytes are written past the buffer boundary.

Attack Vector

Exploitation requires only network reachability to the SIPp listener. An unauthenticated attacker sends a single SIP message containing a header whose content exceeds 20,490 bytes. Because SIPp is commonly deployed on internal test networks that terminate real SIP traffic, any peer that can deliver a SIP message to the process can trigger the crash.

cpp

// Patch: bound get_header() writes against last_header buffer size
// Source: https://github.com/SIPp/sipp/commit/8ddfb43359703e665041a955543e07f504f80232
 {
     /* non reentrant. consider accepting char buffer as param */
     static char last_header[MAX_HEADER_LEN * 10];
+    const char *last_header_end = last_header + sizeof(last_header);
     const char *cptr;
     char *src, *src_copy, *dest, *start, *ptr;
     bool first_time = true;

The patch introduces last_header_end, a sentinel pointer to the end of the static buffer. Subsequent write operations in the function compare against this pointer to prevent out-of-bounds writes. See the SIPp Pull Request #881 and the VulnCheck Advisory for SIPp for full technical context.

Detection Methods for CVE-2026-90780

Indicators of Compromise

Unexpected termination or repeated crashes of SIPp processes without administrative action
Inbound SIP messages containing individual headers larger than 20,490 bytes
Core dumps from SIPp binaries referencing get_header() or sip_parser.cpp
SIP traffic sources sending malformed or abnormally large INVITE, REGISTER, or OPTIONS messages

Detection Strategies

Inspect SIP traffic at network sensors or SIP-aware proxies for messages exceeding typical header sizes (SIP headers rarely exceed a few kilobytes in production).
Monitor SIPp host processes for abnormal exit codes and signal-11 (SIGSEGV) terminations.
Correlate process crash telemetry with concurrent SIP session logs to identify the offending peer address.

Monitoring Recommendations

Enable core dump collection on SIPp hosts and forward crash artifacts to a centralized log store for retention and analysis.
Alert on SIP packets where a single header line exceeds a defined threshold (for example, 8 KB) at network intrusion detection sensors.
Track process uptime and restart counts for SIPp services to surface repeated crash-loop conditions.

How to Mitigate CVE-2026-90780

Immediate Actions Required

Upgrade SIPp to a build that includes commit 8ddfb43359703e665041a955543e07f504f80232 or later.
Restrict network reachability to SIPp listeners so only trusted SIP peers can send messages to the process.
Audit any automation, CI/CD pipelines, or lab environments that run SIPp as a long-lived listener exposed to untrusted networks.

Patch Information

The fix is delivered by SIPp commit 8ddfb43, which bounds get_header() writes against the last_header buffer size. The change is tracked in SIPp Pull Request #881. Rebuild SIPp from source at a revision that includes this commit, or track upstream releases on the SIPp GitHub repository for a tagged version containing the fix.

Workarounds

Place SIPp behind a SIP-aware proxy or SBC that rejects messages containing headers over a safe size threshold.
Run SIPp only on isolated test networks with strict access control lists limiting inbound SIP traffic to known peers.
Automatically restart the SIPp process via a supervisor (for example, systemd with Restart=on-failure) to reduce downtime while patching is in progress.

bash

# Example systemd override to auto-restart SIPp after a crash
# /etc/systemd/system/sipp.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=5s

# Reload and apply
sudo systemctl daemon-reload
sudo systemctl restart sipp