What is the CVSS score of CVE-2026-45538?

CVE-2026-45538 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of OpenSIPS are affected by CVE-2026-45538?

OpenSIPS SIP server versions 4.0.0 and prior contain a critical stack buffer overflow in the sip_to_json() function that enables unauthenticated remote code execution or denial of service via…

How to fix or mitigate CVE-2026-45538?

Within 24 hours, inventory all OpenSIPS deployments and identify systems running versions 4.0.0 or earlier, especially those exposed to untrusted networks. Within 7 days, implement firewall rules restricting access to SIP port 5060 (UDP/TCP) to trusted sources only, and disable the sip_to_json() function in routing scripts if not operationally required; document all active uses of this function. Within 30 days, evaluate upgrade feasibility to OpenSIPS 4.0.1 or later once available, or assess migration to alternative SIP server platforms; establish a vendor notification monitoring process to deploy patches immediately upon release.

OpenSIPS CVE-2026-45538

EUVD-2026-52919 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-08-04 GitHub_M

RCE Buffer Overflow Stack Overflow Opensips

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on the non-default routing-script use of sip_to_json() and, for RCE, unhardened builds; full CIA impact on the process.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 21:35 vuln.today

CVE Published

Aug 04, 2026 - 20:47 cve.org

CRITICAL 9.8

DescriptionCVE.org

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.

AnalysisAI

Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().

Technical ContextAI

OpenSIPS is an open-source SIP proxy/server used for VoIP routing, load balancing, and SBC functions. The flaw is a classic CWE-121 stack-based buffer overflow located in sip_to_json() within modules/sipmsgops/sipmsgops.c. The SIP parser permits header names of roughly 65,000 bytes, but sip_to_json() copies the header name into a 255-byte fixed stack buffer using memcpy with the full parser-reported length and no bounds check. The overflow overwrites the saved frame pointer and return address on the stack, a directly exploitable memory-corruption primitive because the overwrite length and content are both derived from the attacker's SIP message. The affected code path is only reachable when the operator's routing script explicitly calls the sip_to_json() function.

RemediationAI

No vendor-released patch identified at time of analysis - the issue was unfixed at publication, so upgrading is not yet an option; monitor the vendor advisory at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3 for a patched release. As the most effective compensating control, remove or avoid calls to sip_to_json() in the OpenSIPS routing script, which fully eliminates the vulnerable code path at the cost of losing that JSON-conversion functionality. Where sip_to_json() must remain, restrict access to the SIP UDP port 5060 via firewall/ACLs to trusted peers only and deploy SIP-aware filtering to drop messages containing header names exceeding 255 bytes, accepting that this may block legitimate-but-unusual traffic; ensure the OpenSIPS binary is compiled with stack protections (stack canaries, ASLR, NX) to downgrade a successful overflow from RCE to a crash, though this does not prevent denial of service.