What is the CVSS score of CVE-2026-45705?

CVE-2026-45705 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

OpenSIPS CVE-2026-45705

MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-04 GitHub_M

Buffer Overflow Information Disclosure Opensips

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

6.5 MEDIUM

CWE-125 out-of-bounds read via strncmp() can expose adjacent memory contents, warranting C:L over official C:N; remaining metrics align with the vendor vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 01:51 vuln.today

Analysis Generated

Aug 05, 2026 - 01:51 vuln.today

DescriptionCVE.org

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

AnalysisAI

Out-of-bounds read in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows unauthenticated remote attackers to trigger memory over-reads in the multipart SIP body parser by sending a crafted message with Content-Type: multipart/mixed whose body contains "--" within two to three bytes of the buffer end. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-prerequisite exploitation with low availability impact, though the reporter's "Information Disclosure" tag conflicts with the official C:N rating, suggesting potential memory leakage beyond what the score reflects. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are confirmed in 3.6.6 and 4.0.0-rc1.

Technical ContextAI

OpenSIPS is a high-performance, open-source SIP proxy and registrar written in C, widely deployed in VoIP and telecommunications infrastructure. The vulnerability resides in parser/parse_body.c within the find_line_delimiter() function, responsible for locating MIME multipart boundary delimiters as defined in RFC 2046 when processing SIP message bodies. The function uses strncmp() to compare delimiter.len bytes (typically 20-70 bytes, the configured boundary string) against candidate positions in the buffer but failed to verify that sufficient bytes remained before the buffer limit (plimit) prior to the comparison. CPE cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:* confirms all versioned releases prior to the fix are affected. CWE-125 (Out-of-bounds Read) classifies the root cause: strncmp() reads past the logical end of the body buffer when a "--" pattern appears within two to three bytes of the end without a following delimiter. The fix applied in commit 4d23613b65579b073784a07a65d3bf52443a4efb adds an early guard - if (plimit - cp1 < 2 + delimiter.len) return NULL - before the strncmp call, preventing the over-read. The accompanying commit 5f103effaf5f372cccffe0b138f16998eba12668 addresses related bounds issues in URI construction, TCP header parsing, and base64 encoding across the codebase.

RemediationAI

Upgrade to OpenSIPS 3.6.6 (stable branch) or 4.0.0-rc1 (development branch); both are confirmed fix versions per the GitHub security advisory at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp, with the source-level fix applied in commits 4d23613b65579b073784a07a65d3bf52443a4efb and 5f103effaf5f372cccffe0b138f16998eba12668. Verify package availability from your distribution or build from the patched upstream source. If immediate upgrade is not operationally feasible, restrict inbound SIP traffic to known, trusted source IP ranges at the network perimeter using firewall ACLs or SIP-aware load balancers - this limits the attack surface but is not suitable for public-facing SIP infrastructure where anonymous callers are expected. Disabling multipart body parsing at the SIP routing script level (by rejecting or dropping messages with Content-Type: multipart/mixed before they reach the parser) eliminates the vulnerable code path entirely but breaks legitimate RFC 2046 multipart SIP features such as SDP combined with MIME attachments.