OpenSIPS CVE-2026-45809
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated DoS; AC:L because both attack steps are fully attacker-controlled; A:H for worker process crash; C:N/I:N as impact is availability-only with no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
AnalysisAI
Stack-based buffer overflow in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 allows a remote unauthenticated attacker to crash worker processes by exploiting the watcherinfo XML generation path in the presence module. The attacker sends a SIP SUBSCRIBE with a From URI exceeding 200 characters, establishing an oversized watcher entry, then triggers presence.winfo generation to overflow a fixed-size stack buffer in create_winfo_xml() within notify.c. No public exploit has been identified at time of analysis, but the unauthenticated network vector and straightforward two-step attack path make this a credible denial-of-service risk for any SIP infrastructure exposing presence services.
Technical ContextAI
OpenSIPS is an open-source SIP (Session Initiation Protocol) server widely used in VoIP, unified communications, and telecom routing infrastructure. The vulnerable code resides in modules/presence/notify.c, specifically the create_winfo_xml() function. Prior to the fix, a fixed 200-byte stack buffer (char content[200]) was used as an intermediate staging area to hold a watcher URI before passing it to libxml2's xmlNewChild(). The strncpy() call copied w->uri.len bytes from the stored watcher URI without bounds-checking against the 200-byte ceiling, satisfying CWE-121 (Stack-based Buffer Overflow). Because SIP From URIs are attacker-controlled and can be arbitrarily long, any URI exceeding 200 bytes overflows the stack frame, corrupting adjacent memory and crashing the process. The commit diff confirms the fix eliminates the intermediate buffer entirely, instead calling xmlNodeSetContentLen() to pass the URI string and its true length directly to libxml2, which handles memory safely. The vulnerability path requires the presence module (handle_subscribe routing) and presence_xml module (watcherinfo generation) both to be loaded.
Affected ProductsAI
OpenSIPS versions prior to 3.6.6 on the stable branch and versions prior to 4.0.0-rc1 on the development branch are affected. The vulnerable code is in modules/presence/notify.c within the create_winfo_xml() function. No CPE strings were included in the provided intelligence data; affected versions are confirmed by the GitHub security advisory at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56. Both the 3.x and 4.x release lines are affected, and only systems with the presence and presence_xml modules loaded are exploitable.
RemediationAI
Upgrade to OpenSIPS 3.6.6 (stable) or 4.0.0-rc1 (development), which resolve the issue by replacing the fixed 200-byte stack buffer with a direct xmlNodeSetContentLen() call. The fixing commits are c5970d3ee25b457ad2d78fe6e9662a12dae577cd and dd86461b71ff4a4f5194205896ae5f48f144240d, both available on the OpenSIPS GitHub repository. If immediate patching is not feasible, the most effective workaround is to remove or not load the presence and presence_xml modules - note this eliminates all SIP presence functionality, which may be operationally disruptive. A less disruptive alternative is to restrict SUBSCRIBE routing so that external or untrusted sources cannot reach the handle_subscribe() handler; this can be accomplished via SIP proxy ACLs, firewall rules blocking SUBSCRIBE from untrusted IP ranges, or OpenSIPS route-level authorization checks. The trade-off is that overly broad restrictions may break legitimate presence subscriptions from authenticated clients. The vendor advisory is at https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today