Vulnerabilities

TI-2026-34055 CVE-2026-46334

OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

HIGH 77

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00666 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-20

TI-2026-33544 CVE-2026-45809

OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI

HIGH 77

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00637 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-121

TI-2026-33446 CVE-2026-45705

OpenSIPS: OOB Read in Multipart Body Boundary Parsing

MEDIUM 57

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-125

TI-2026-33289 CVE-2026-45537

OpenSIPS: Global Buffer Overflow in construct_uri

HIGH 80

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00626 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-120

TI-2026-32942 CVE-2026-45103

OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow

HIGH 72

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-190

TI-2026-32940 CVE-2026-45100

OpenSIPS: Buffer Overflow in Base64 Encode Transformation

HIGH 78

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00834 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-120

TI-2026-32931 CVE-2026-45084

OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state

HIGH 77

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00655 Published 2026-08-04 Fixed in 3.6.6, 4.0.0-rc1 CWE-476

TI-2026-33290 CVE-2026-45538

OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy

HIGH 82

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00802 Published 2026-08-04 No fix listed CWE-121

TI-2026-20661 CVE-2026-25554 · GHSA-7f98-q4h8-rf6r

OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass

LOW 36

OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00364 Published 2026-02-25 Fixed in 3.6.4 CWE-89

TI-2023-12678 CVE-2023-28099

OpenSIPS has vulnerability in the ds_is_in_list() function

LOW 35

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00905 Published 2023-03-15 Fixed in 3.1.9, 3.2.6 CWE-20

TI-2023-12677 CVE-2023-28098

OpenSIPS has vulnerability in the Digest Authentication Parser

LOW 35

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00905 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-20

TI-2023-12676 CVE-2023-28097

OpenSIPS has vulnerability in the Content-Length Parser

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-03-15 Fixed in 3.1.9, 3.2.6 CWE-190

TI-2023-12675 CVE-2023-28096

OpenSIPS has memory leak in cJSON lib

LOW 34

OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00767 Published 2023-03-15 Fixed in 3.1.8, 3.2.5 CWE-401

TI-2023-12674 CVE-2023-28095

OpenSIPS has vulnerability in the building the local negative replies

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00969 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-20

TI-2023-12311 CVE-2023-27601

OpenSIPS has vulnerability in the codec_delete_XX() functions

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-20

TI-2023-12310 CVE-2023-27600

OpenSIPS has vulnerability in the codec_delete_XX() functions

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-20

TI-2023-12309 CVE-2023-27599

OpenSIPS has vulnerability in the parse_to_param() function

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-20

TI-2023-12308 CVE-2023-27598

OpenSIPS has vulnerability in the parse_via() function

MEDIUM 41

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00971 Published 2023-03-15 Fixed in 3.1.7, 3.2.4 CWE-908

TI-2023-12307 CVE-2023-27597

OpenSIPS has vulnerability in the parse_uri() function

MEDIUM 40

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00738 Published 2023-03-15 Fixed in 3.1.8, 3.2.5 CWE-20

TI-2023-12306 CVE-2023-27596

OpenSIPS has vulnerability in the codec_delete_XX() functions

MEDIUM 40

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00738 Published 2023-03-15 Fixed in 3.1.8, 3.2.5 CWE-770

TI-2013-03243 CVE-2013-3722 · GHSA-gf9x-6xqh-g38j

A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.

LOW 35

A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01106 Published 2020-02-17 No fix listed CWE-835

Vulnerabilities

Filters