How to fix or mitigate CVE-2026-45084?

Within 24 hours, inventory all OpenSIPS systems to identify which are running vulnerable versions 3.4.0-3.6.5 or 4.0.0-beta and assess which systems are business-critical. Within 7 days, begin patching by upgrading production systems to OpenSIPS 3.6.6 (for 3.x line) or 4.0.0-rc1 (for 4.0 line) in priority order, conducting testing in lower environments first to validate compatibility. Within 30 days, complete patching across all affected OpenSIPS installations, verify VoIP service functionality end-to-end, and review SIP firewall rules to restrict unexpected PUBLISH requests where feasible.

OpenSIPS CVE-2026-45084

Q: What is the CVSS score of CVE-2026-45084?

CVE-2026-45084 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

Q: Which versions of OpenSIPS are affected by CVE-2026-45084?

A high-severity vulnerability in OpenSIPS VoIP proxy servers (versions 3.4.0-3.6.5 and 4.0.0-beta) allows remote attackers to crash the server with a single malicious SIP request, directly disrupting…. A patch is available.

EUVD-2026-52933 HIGH

NULL Pointer Dereference (CWE-476)

2026-08-04 GitHub_M

Denial Of Service Null Pointer Dereference Opensips

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable crash requiring no authentication on the code path; non-default enable_sphere_check=1 is a target-side prerequisite, not an attack complexity factor per CVSS 3.1 AC definition.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 00:09 vuln.today

Patch available

Aug 04, 2026 - 22:02 EUVD

CVE Published

Aug 04, 2026 - 21:23 cve.org

HIGH 8.7

DescriptionCVE.org

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.

AnalysisAI

Denial of service in OpenSIPS versions 3.4.0 through 3.6.5 and 4.0.0-beta allows remote attackers to crash the server with a single crafted SIP PUBLISH request targeting the presence module. The crash stems from a NULL pointer dereference in handle_publish() triggered when enable_sphere_check=1 is configured: get_content_type() is invoked without first calling parse_content_type_hdr(), leaving Content-Type parsing state uninitialized and producing a segmentation fault via either a NULL parsed sub-pointer or a NULL content_type pointer. No public exploit has been identified at time of analysis, but the attack mechanics are fully described in the vendor advisory (GHSA-h3ww-hchh-x2g9), and the fix is available in 3.6.6 and 4.0.0-rc1.

Technical ContextAI

OpenSIPS is an open-source SIP (Session Initiation Protocol) server written in C, widely deployed in VoIP and telecommunications infrastructure as a proxy, registrar, and application server. The affected component is the presence module, which implements RFC 3903 SIP event publication. The root cause is CWE-476 (NULL Pointer Dereference): the handle_publish() function conditionally invokes the get_content_type() macro when enable_sphere_check=1 is active, but omits the prerequisite call to parse_content_type_hdr() that initializes the msg->content_type parsing state. Two dereference paths both lead to a crash: when a Content-Type header is present but has not been parsed, msg->content_type->parsed is NULL and is cast as a content_t pointer; when no Content-Type header is present at all, msg->content_type itself is NULL. Both are classic C null-pointer dereferences that terminate the process. The CPE cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:* covers all platforms running affected versions; EUVD-2026-52933 independently corroborates the version ranges.

RemediationAI

The primary fix is to upgrade to OpenSIPS 3.6.6 (for 3.x deployments) or 4.0.0-rc1 (for 4.x early-adopters), both of which resolve the NULL dereference by ensuring parse_content_type_hdr() is called before get_content_type() is invoked in handle_publish(). The vendor advisory at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9 provides authoritative upgrade guidance. For deployments that cannot patch immediately, the most direct workaround is to set enable_sphere_check=0 in the presence module configuration and reload OpenSIPS - this disables the vulnerable code path entirely; the trade-off is that sphere-based filtering in presence event handling will be inactive, which may affect deployments relying on that feature for policy enforcement. A secondary compensating control is to require SIP authentication for PUBLISH requests in the OpenSIPS routing script before requests reach the presence module, limiting exposure to authenticated senders; note that this does not fix the underlying crash but reduces the attacker population. Network-level filtering of SIP PUBLISH traffic to trusted source IPs at the firewall or SBC layer provides additional depth but should not be the sole control.