Loading story…
OpenSIPS disclosed CVE-2026-45100, a critical remotely exploitable buffer overflow in the {s.b64encode} string transformation affecting versions 3.4.0-beta through 3.6.5 and 4.0.0-beta. The flaw stems from validating only the pre-encoding input against a 64 KB buffer, even though Base64 expansion can increase output size enough to overflow the buffer by up to 21,844 bytes. An attacker can trigger the issue by sending a SIP message with a very large header value when an OpenSIPS routing script applies {s.b64encode} to attacker-controlled data.
The overflow can corrupt adjacent transformation buffers and alter values used by later transformations processing the same SIP message, creating integrity and availability risk. OpenSIPS addressed the issue through code changes that enforce stricter bounds checks on input-derived lengths and related parsing logic across the codebase, including Base64 encoding and other buffer-sensitive components. The vendor fixed the vulnerability in OpenSIPS 3.6.6 and 4.0.0-rc1; the flaw is tracked as CWE-120 and carries a CVSS 9.1 rating.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 4, 2026, CVE-2026-45100 was published describing a critical remote buffer overflow in OpenSIPS {s.b64encode} affecting versions 3.4.0-beta through 3.6.5 and 4.0.0-beta before 4.0.0-rc1. The disclosure states the flaw was fixed in OpenSIPS 3.6.6 and 4.0.0-rc1 and assigned a CVSS 9.1 score.
On May 13, 2026, OpenSIPS committed fixes that add bounds checks for input-derived lengths, including correcting the base64 output length check in transformations.c to account for 4/3 expansion. The changes were committed in both the 3.6 and 4.0 branches via commits 4d23613 and 5f103ef.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSIPS disclosed **CVE-2026-46334**, a remotely triggerable denial-of-service flaw in SDP bandwidth-line parsing that affects versions prior to **3.6.6** and **4.0.0-rc1**. A malformed session-level `b=` SDP line missing the required `:` delimiter can corrupt parsed bandwidth metadata, and if that corrupted SDP state is later cloned during dialog handling or QoS processing, an OpenSIPS worker process can crash. The issue is exploitable by an unauthenticated attacker in deployments that parse attacker-controlled SDP and use affected routing or module logic. The fix was introduced through OpenSIPS commits that harden `parser/sdp/sdp_helpr_funcs.c` by rejecting malformed bandwidth lines, adding boundary checks, and preventing unsafe access when `b=` appears at the start of the buffer or lacks a separator. The patched code logs an error and returns failure for invalid SDP bandwidth encoding, closing the crash path in both the **3.6** and **4.0.0** code lines. The vulnerability is mapped to **CWE-20** and **CWE-476** and carries high availability impact.
Aug 5, 2026
Two high-severity vulnerabilities were disclosed in **PJSIP** affecting version `2.16` and earlier, exposing the widely used multimedia communication library to memory corruption risks. `CVE-2026-40614` is a **heap buffer overflow** in the Opus codec decode path, where insufficient validation of buffer sizes allows `codec_decode()` to copy more data than allocated after `codec_parse()` emits encoded frames larger than the FEC decode buffer calculation anticipates. The flaw is tied to unchecked `pj_memcpy()` operations and was classified as `CWE-122`, with high potential impact to confidentiality, integrity, and availability. A second issue, `CVE-2026-40892`, is a **stack buffer overflow** in `pjsip_auth_create_digest2()` when pre-computed digest credentials are supplied through `PJSIP_CRED_DATA_DIGEST`. In that path, credential data is copied using `cred_info->data.slen` without enforcing the expected digest-length limit, allowing overflow of the fixed 128-byte `ha1` stack buffer. The vulnerability was classified as `CWE-121`, and both CVEs were published with GitHub advisory references and fixing commits, indicating that maintainers have issued patches for affected deployments.
Jun 29, 2026
OpenSIPS disclosed **CVE-2026-45809**, a high-severity denial-of-service flaw in watcherinfo XML generation that can let a remote attacker crash a worker process. The bug affects versions prior to **3.6.6** and **4.0.0-rc1** and is triggered when an attacker sends a `SUBSCRIBE` presence request with an excessively long `From` URI, creating an oversized watcher entry that later causes a stack buffer overflow during `presence.winfo` XML generation. The issue is classified as **CWE-121** and impacts deployments that expose `handle_subscribe()` with watcherinfo enabled through the **presence** and **presence_xml** modules. OpenSIPS maintainers patched the flaw in commits `c5970d3ee25b457ad2d78fe6e9662a12dae577cd` and `dd86461b71ff4a4f5194205896ae5f48f144240d`, replacing a fixed **200-byte** stack buffer with a length-aware XML API call. The fix changes watcher URI handling so XML nodes are created without inline content and then populated using `xmlNodeSetContentLen`, preventing long URIs from overflowing the buffer during winfo processing. Organizations running exposed OpenSIPS presence services are advised to upgrade to the fixed releases.
Aug 6, 2026