Which versions of OpenSIPS are affected by CVE-2026-46334?

OpenSIPS versions prior to 3.6.6 contain a remotely exploitable denial-of-service vulnerability in SDP parsing that allows unauthenticated attackers to crash worker processes, disrupting SIP-based…

How to fix or mitigate CVE-2026-46334?

Within 24 hours, identify all OpenSIPS instances and confirm version status; assess the operational impact of service loss for each deployment. Within 7 days, implement compensating controls including SIP-aware network filtering to validate SDP bandwidth line format (reject requests with malformed or missing colon delimiters), rate limiting on inbound SIP requests, and network segmentation to limit DoS blast radius. Within 30 days, establish a monitoring protocol for vendor security advisories regarding patch availability, and develop contingency procedures for failover to backup communication channels in case of attack.

OpenSIPS CVE-2026-46334

Q: What is the CVSS score of CVE-2026-46334?

CVE-2026-46334 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

HIGH

NULL Pointer Dereference (CWE-476)

2026-08-04 GitHub_M

Denial Of Service Null Pointer Dereference Opensips

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-delivered single-packet trigger, no authentication required per description and CVSS 4.0 PR:N, pure availability impact, scope unchanged as crash is contained to the local worker process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 00:29 vuln.today

Analysis Generated

Aug 05, 2026 - 00:29 vuln.today

CVE Published

Aug 04, 2026 - 23:50 cve.org

HIGH 8.7

DescriptionCVE.org

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

AnalysisAI

Denial of service in OpenSIPS SIP server versions prior to 3.6.6 allows an unauthenticated remote attacker to crash worker processes by sending a SIP request containing a malformed SDP bandwidth line that omits the required colon delimiter. The crafted payload triggers a null pointer dereference (CWE-476) in the SDP parsing layer; when dialog or QoS modules subsequently clone the corrupted SDP state, the worker process terminates abnormally. No active exploitation is confirmed at time of analysis, though publicly readable patch commits expose the exact byte-level trigger, significantly lowering the barrier to exploit construction.

Technical ContextAI

OpenSIPS (cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*) is a high-performance SIP proxy, registrar, and B2BUA written in C. The vulnerability resides in the extract_bwidth() function within parser/sdp/sdp_helpr_funcs.c. Per RFC 4566, SDP bandwidth lines must take the form b=<bwtype>:<bandwidth>; when the mandatory colon is absent, the strchr call used to locate it returns NULL. The pre-fix code then advances two characters past this NULL pointer (cp1 + 2) to populate bwtype->s, writing a wild pointer into the parsed SDP bandwidth structure. CWE-476 (Null Pointer Dereference) precisely describes this root cause. Critically, the crash is not immediate at parse time - the corrupted metadata propagates silently until a deep-clone of the SDP structure is triggered by the dialog or QoS modules during call state management, at which point the dereference faults the worker process. The fix, visible in commit 8fe74b01, introduces an explicit NULL guard before pointer arithmetic and returns an error code, preventing the corrupted state from being cloned downstream.

RemediationAI

Upgrade to OpenSIPS 3.6.6 (stable branch) or 4.0.0-rc1 (release-candidate branch) to apply the vendor-released patch; these are the exact fix versions confirmed by the GitHub security advisory GHSA-rh36-mhpv-cx2r. The upstream fix is contained in commits 8fe74b01f6fbf86c0b5e290735275530cb65e0fb and ac5309d5b8206cd3dbe1b4e01567c8db1ce31444 in the OpenSIPS GitHub repository. If immediate upgrade is not feasible, a compensating control is to add SDP validation logic in the routing script that drops or rejects SIP requests whose SDP body contains bandwidth lines lacking the mandatory colon delimiter before they reach dialog or QoS processing - for example, by inspecting the raw SDP body with OpenSIPS string-matching functions or deploying a perimeter SBC that validates SDP conformance per RFC 4566. Additionally, rate-limiting SIP INVITE traffic from untrusted source addresses at a border firewall or SBC reduces the window for a sustained multi-worker DoS. Note that scripted workarounds require expertise to implement correctly and do not eliminate the underlying parser flaw; patching remains the definitive resolution.