Read the docs
TI-2026-33289 Aliases CVE-2026-45537

OpenSIPS: Global Buffer Overflow in construct_uri

Priority HIGH 80CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed opensips (OpenSIPS): 3.6.6, 4.0.0-rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSIPSopensips3.4.0 to before 3.6.6; 4.0.0-beta to before 4.0.0-rc13.6.6, 4.0.0-rc1Patch availableCNA
  • opensips VendorOpenSIPS Affected 3.4.0 to before 3.6.6; 4.0.0-beta to before 4.0.0-rc1 Fixed in 3.6.6, 4.0.0-rc1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*——OpenSIPS
  • cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:* Versions — — ·OpenSIPS

Remediation

  • Fix · CNA opensips (OpenSIPS) Fixed in 3.6.6, 4.0.0-rc1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45537
  2. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Other 3

  • TI-2026-33290 OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy CVSS 3.1CRITICAL 9.8
  • TI-2026-32940 OpenSIPS: Buffer Overflow in Base64 Encode Transformation CVSS 3.1CRITICAL 9.1
  • TI-2026-34055 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning CVSS 4.0HIGH 8.7
  • TI-2026-33544 OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI CVSS 4.0HIGH 8.7
  • TI-2026-32931 OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state CVSS 4.0HIGH 8.7
  • TI-2026-32942 OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences