Loading story…
OpenSIPS disclosed CVE-2026-46334, a remotely triggerable denial-of-service flaw in SDP bandwidth-line parsing that affects versions prior to 3.6.6 and 4.0.0-rc1. A malformed session-level b= SDP line missing the required : delimiter can corrupt parsed bandwidth metadata, and if that corrupted SDP state is later cloned during dialog handling or QoS processing, an OpenSIPS worker process can crash. The issue is exploitable by an unauthenticated attacker in deployments that parse attacker-controlled SDP and use affected routing or module logic.
The fix was introduced through OpenSIPS commits that harden parser/sdp/sdp_helpr_funcs.c by rejecting malformed bandwidth lines, adding boundary checks, and preventing unsafe access when b= appears at the start of the buffer or lacks a separator. The patched code logs an error and returns failure for invalid SDP bandwidth encoding, closing the crash path in both the 3.6 and 4.0.0 code lines. The vulnerability is mapped to CWE-20 and CWE-476 and carries high availability impact.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record states that security-advisories@github.com received the advisory for CVE-2026-46334 on August 5, 2026. The issue describes a remotely triggerable denial-of-service flaw in OpenSIPS SDP bandwidth parsing affecting versions before 3.6.6 and 4.0.0-rc1.
OpenSIPS committed code changes to reject malformed SDP "b=" bandwidth lines in the SDP parser, adding validation for missing colon separators and other unsafe parsing conditions. The fixes were committed in both the 3.6 and 4.0 code lines and are referenced as the remediation for CVE-2026-46334.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSIPS disclosed **CVE-2026-45100**, a critical remotely exploitable buffer overflow in the `{s.b64encode}` string transformation affecting versions **3.4.0-beta through 3.6.5** and **4.0.0-beta**. The flaw stems from validating only the pre-encoding input against a 64 KB buffer, even though Base64 expansion can increase output size enough to overflow the buffer by up to **21,844 bytes**. An attacker can trigger the issue by sending a SIP message with a very large header value when an OpenSIPS routing script applies `{s.b64encode}` to attacker-controlled data. The overflow can corrupt adjacent transformation buffers and alter values used by later transformations processing the same SIP message, creating integrity and availability risk. OpenSIPS addressed the issue through code changes that enforce stricter bounds checks on input-derived lengths and related parsing logic across the codebase, including Base64 encoding and other buffer-sensitive components. The vendor fixed the vulnerability in **OpenSIPS 3.6.6** and **4.0.0-rc1**; the flaw is tracked as **CWE-120** and carries a **CVSS 9.1** rating.
Aug 5, 2026
OpenSIPS disclosed **CVE-2026-45809**, a high-severity denial-of-service flaw in watcherinfo XML generation that can let a remote attacker crash a worker process. The bug affects versions prior to **3.6.6** and **4.0.0-rc1** and is triggered when an attacker sends a `SUBSCRIBE` presence request with an excessively long `From` URI, creating an oversized watcher entry that later causes a stack buffer overflow during `presence.winfo` XML generation. The issue is classified as **CWE-121** and impacts deployments that expose `handle_subscribe()` with watcherinfo enabled through the **presence** and **presence_xml** modules. OpenSIPS maintainers patched the flaw in commits `c5970d3ee25b457ad2d78fe6e9662a12dae577cd` and `dd86461b71ff4a4f5194205896ae5f48f144240d`, replacing a fixed **200-byte** stack buffer with a length-aware XML API call. The fix changes watcher URI handling so XML nodes are created without inline content and then populated using `xmlNodeSetContentLen`, preventing long URIs from overflowing the buffer during winfo processing. Organizations running exposed OpenSIPS presence services are advised to upgrade to the fixed releases.
Aug 6, 2026
**CVE-2023-2177** is a moderate-severity NULL-pointer dereference in the Linux kernel's SCTP stream scheduler, in `net/sctp/stream_sched.c`. On kernels before version 5.19, a failed `stream_in` allocation can free `stream_out` before later code accesses it. A local low-privileged user could trigger a kernel crash and cause denial of service; the issue has no reported confidentiality or integrity impact and carries a Red Hat CVSS v3.1 score of 5.5. An upstream patch corrected SCTP association and stream-initialization error handling by routing failed `sctp_stream_init()` operations through the dedicated stream cleanup path and centralizing allocation-failure cleanup. Red Hat issued errata for affected Red Hat Enterprise Linux 8, RHEL 8.6 Extended Update Support, and RHEL 9 kernel packages; RHEL 6 and 7 variants were listed as not affected. Organizations should deploy the applicable kernel updates, as no separate mitigation is available.
Aug 26, 2026