SIPGO EUVD-2026-84817

Exploitable only against services built on the sipgo library that expose a stream transport - specifically TCP, TLS, WS, or WSS listeners (datagram/UDP transport is not implicated by the described stream-parser path). No authentication, user interaction, or special configuration is required: an unauthenticated remote peer sends one SIP message with an attacker-controlled oversized Content-Length header (up to 2^32-1). The limiting factors are that the target must be running sipgo at or below version 1.4.0 with a stream listener reachable by the attacker; the ParseMaxMessageLength (65535) guard exists but runs too late in ParseNext to prevent the allocation. Impact is availability-only (memory exhaustion), with no path to code execution or data disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: an unauthenticated, network-reachable, low-complexity availability-only attack (memory exhaustion). No confidentiality or integrity impact, so the 7.5 is driven entirely by A:H. A working proof-of-concept exists in the GHSA advisory (a single INVITE with Content-Length: 4000000000), so publicly available exploit code exists, but this is NOT evidence of active exploitation. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input; absence of those is not an error but does limit prioritization precision. Real-world risk is moderate rather than urgent: the flaw is trivially triggerable and pre-authentication, but the affected component is a niche Go SIP library rather than a widely deployed product, and the impact is a transient DoS (out-of-memory) rather than code execution or data loss. A single oversized-length message forces a large allocation (up to 2^32-1 bytes) before the ParseMaxMessageLength (65535) guard runs. Priority should be treated as high for the specific population running sipgo stream transports on exposed SIP endpoints, and low-to-moderate globally given the small deployment footprint. The signals do not conflict; the main caveat is simply the missing EPSS/KEV/SSVC telemetry.

An attacker with network reach to a SIP service built on sipgo opens a TCP/TLS/WS/WSS stream and sends a single SIP message (e.g. an INVITE) declaring an enormous Content-Length such as 4000000000 with no actual body. The parser allocates a body buffer sized to the attacker-declared length before the size limit is enforced, exhausting memory and crashing or hanging the service. A functional PoC message is published in the GHSA-pg59-5vwg-4jxq advisory, making exploitation trivial and repeatable.