EUVD-2026-52975Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but exploitation needs a non-default routing config that base64-encodes attacker input, so AC:H; corruption affects integrity and availability with no data disclosure, so C:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
AnalysisAI
Adjacent-buffer overflow in OpenSIPS 3.4.0-beta through 3.6.5 and 4.0.0-beta arises in the {s.b64encode} string transformation, where the size check only validates that the input fits the 64 KB transformation buffer but ignores the ~33% expansion that base64 encoding introduces. Remote attackers can send a SIP message with a header value of roughly 50,000+ bytes to overflow the buffer by up to 21,844 bytes into an adjacent transformation buffer, corrupting values used by chained transformations on the same message; exploitability hinges on the routing script applying {s.b64encode} to attacker-controlled input. No public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available in 3.6.6 and 4.0.0-rc1.
Technical ContextAI
OpenSIPS is a high-performance open-source SIP proxy/server used in VoIP, telephony, and messaging infrastructure. The flaw lives in transformations.c, in the string-transformation engine that applies operators like {s.b64encode} to pseudo-variable values extracted from SIP messages. These transformations write into a fixed-size scratch buffer (TR_BUFFER_SIZE, 64 KB); base64 encoding produces about 4 output bytes for every 3 input bytes, so the vulnerable guard checked only the raw input length rather than the encoded output length (calc_base64_encode_len). This is a classic CWE-120 buffer copy without checking the size of the destination. Because the transformation buffers are laid out contiguously and reused across chained transformations, the overflow corrupts a neighboring buffer whose contents feed subsequent operators on the same SIP message.
RemediationAI
Vendor-released patch: upgrade to OpenSIPS 3.6.6 (3.6.x branch) or 4.0.0-rc1 (4.0.x branch), which add an output-length check via calc_base64_encode_len before writing to the transformation buffer; follow the advisory at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68. If you cannot patch immediately, audit your routing script and stop applying {s.b64encode} to attacker-controlled input such as raw SIP header values, since exploitation requires that specific data flow; alternatively cap the size of untrusted input before transformation (reject or truncate header values well below ~49,153 bytes), noting that overly aggressive length limits may drop legitimately large headers. Restricting network reachability of the SIP listener to trusted peers and enforcing upstream SIP message-size limits (e.g., at a session border controller) further reduces exposure, at the cost of interoperability with untrusted or federated endpoints.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today