CVE-2026-45538: OpenSIPS Stack Buffer Overflow via Oversized SIP Header

Executive Summary

A critical stack buffer overflow vulnerability (CVE-2026-45538) has been disclosed in OpenSIPS, a widely deployed open-source SIP (Session Initiation Protocol) server. Versions 4.0.0 and prior are affected. An attacker can trigger the overflow — potentially achieving remote code execution — by sending a single SIP message containing a header name longer than 255 bytes.

CVSS Score: 9.8 (Critical)

The vulnerability exists in the sip_to_json() function of the sipmsgops module, which fails to validate the length of SIP header names before copying them into a fixed-size stack buffer.

Vulnerability Overview

Affected Versions

Technical Analysis

OpenSIPS processes incoming SIP messages and makes them available to routing scripts. When a routing script calls sip_to_json(), the function iterates over the SIP message headers and writes them into a JSON structure. The vulnerable code path in modules/sipmsgops/sipmsgops.c copies a SIP header name into a fixed 255-byte stack buffer without validating the source length:

/* Simplified pseudocode of the vulnerable pattern */
char hdr_name[255];
strncpy(hdr_name, hdr->name.s, hdr->name.len);  /* No bounds check on hdr->name.len */

An attacker who can deliver a crafted SIP message to an OpenSIPS instance with sip_to_json() in its routing script can overflow the stack buffer. On systems without stack canaries or ASLR, this directly enables code execution. Even with mitigations, a crash (denial of service) is guaranteed.

Attack Scenario

1. Attacker crafts a SIP INVITE or OPTIONS message
2. The SIP header name field is padded beyond 255 bytes
   X-[255+ 'A' chars]: malicious-value\r\n
3. Message delivered to OpenSIPS over UDP/TCP (port 5060)
4. OpenSIPS routing script calls sip_to_json()
5. Stack buffer overflow overwrites the return address
6. Attacker-controlled shellcode or ROP chain executes

SIP Exposure Profile

OpenSIPS is typically deployed to terminate SIP traffic from external VoIP providers, SIP phones, or softclients. Port 5060 (UDP/TCP) is routinely exposed to the internet, making this vulnerability network-reachable from any source.

Impact

Immediate Remediation

Step 1: Upgrade OpenSIPS

# Check current version
opensipsctl version
# or
opensips -V
 
# Upgrade from packages (Debian/Ubuntu example)
apt-get update && apt-get upgrade opensips
 
# Verify upgraded version
opensips -V

Consult the OpenSIPS GitHub releases for the patched version.

Step 2: Restrict sip_to_json() Usage

Audit your OpenSIPS routing scripts and remove sip_to_json() calls if not required:

# Find all uses in routing scripts
grep -r "sip_to_json" /etc/opensips/
 
# If not needed, remove the call and reload config
opensipsctl reload

Step 3: Add SIP Header Length Validation at the Perimeter

Deploy a SIP-aware firewall or SBC to drop messages with anomalously long headers:

# Example: iptables string match to drop SIP messages with very long header names
# (Illustrative — production SIP firewalls recommended for full coverage)
iptables -I INPUT -p udp --dport 5060 -m string --algo bm --string "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" -j DROP

Step 4: Enable Stack Protection (Kernel/Compiler Mitigations)

Ensure OpenSIPS is compiled with hardening flags and the OS has mitigations active:

# Check ASLR
cat /proc/sys/kernel/randomize_va_space   # Should be 2
 
# Check stack canaries at compile time (if building from source)
CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2" make
 
# Enable NX/DEP at hardware level (typically enabled by default in modern kernels)

Detection Indicators

Workaround

If patching cannot be applied immediately:

1. Remove sip_to_json() from routing scripts to eliminate the vulnerable code path.
2. Restrict SIP port access to known, trusted IP ranges at the firewall level.
3. Deploy a SIP-aware proxy or SBC upstream to inspect and filter malformed messages.
4. Enable core dumps and monitor for crashes to detect exploitation attempts.

References

• NVD — CVE-2026-45538
• OpenSIPS GitHub
• CWE-121: Stack-based Buffer Overflow

Related Reading

• CVE-2026-66902: Google::Auth Perl Command Injection
• CVE-2026-67979: NASA cFS Access Control RCE