CVE-2026-45537 (GCVE-0-2026-45537)

Vulnerability from cvelistv5 – Published: 2026-08-04 22:48 – Updated: 2026-08-05 17:48
VLAI
Title
OpenSIPS: Global Buffer Overflow in construct_uri
Summary
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
Impacted products
Vendor Product Version
OpenSIPS opensips Affected: >= 3.4.0, < 3.6.6
Affected: >= 4.0.0-beta, < 4.0.0-rc1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45537",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T17:47:59.631408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T17:48:44.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opensips",
          "vendor": "OpenSIPS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-beta, \u003c 4.0.0-rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server\u0027s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function\u0027s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T22:48:43.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"
        },
        {
          "name": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"
        },
        {
          "name": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"
        }
      ],
      "source": {
        "advisory": "GHSA-v7h4-fwrc-c66v",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSIPS: Global Buffer Overflow in construct_uri"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45537",
    "datePublished": "2026-08-04T22:48:43.580Z",
    "dateReserved": "2026-05-12T17:48:47.878Z",
    "dateUpdated": "2026-08-05T17:48:44.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45537",
      "date": "2026-08-05",
      "epss": "0.00358",
      "percentile": "0.28488"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45537\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-04T23:16:51.687\",\"lastModified\":\"2026-08-05T18:17:11.353\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server\u0027s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function\u0027s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"OpenSIPS\",\"product\":\"opensips\",\"versions\":[{\"version\":\"\u003e= 3.4.0, \u003c 3.6.6\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.0.0-beta, \u003c 4.0.0-rc1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-05T17:47:59.631408Z\",\"id\":\"CVE-2026-45537\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-120\"}]}],\"references\":[{\"url\":\"https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-05T13:32:05+00:00",
      "cve": "CVE-2026-45537",
      "id": "CVE-2026-45537",
      "initial_release_date": "2026-08-04T22:48:43.580000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "opensips: global buffer overflow in construct_uri",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45537.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"OpenSIPS: Global Buffer Overflow in construct_uri\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-120\", \"lang\": \"en\", \"description\": \"CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v\"}, {\"name\": \"https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb\"}, {\"name\": \"https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668\"}], \"affected\": [{\"vendor\": \"OpenSIPS\", \"product\": \"opensips\", \"versions\": [{\"version\": \"\u003e= 3.4.0, \u003c 3.6.6\", \"status\": \"affected\"}, {\"version\": \"\u003e= 4.0.0-beta, \u003c 4.0.0-rc1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-04T22:48:43.580Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server\u0027s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function\u0027s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.\"}], \"source\": {\"advisory\": \"GHSA-v7h4-fwrc-c66v\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45537\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-05T17:47:59.631408Z\"}}}], \"references\": [{\"url\": \"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-05T17:48:34.277Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45537\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-05-12T17:48:47.878Z\", \"datePublished\": \"2026-08-04T22:48:43.580Z\", \"dateUpdated\": \"2026-08-05T17:48:44.922Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.