Loading story…
OpenSIPS disclosed CVE-2026-45809, a high-severity denial-of-service flaw in watcherinfo XML generation that can let a remote attacker crash a worker process. The bug affects versions prior to 3.6.6 and 4.0.0-rc1 and is triggered when an attacker sends a SUBSCRIBE presence request with an excessively long From URI, creating an oversized watcher entry that later causes a stack buffer overflow during presence.winfo XML generation. The issue is classified as CWE-121 and impacts deployments that expose handle_subscribe() with watcherinfo enabled through the presence and presence_xml modules.
OpenSIPS maintainers patched the flaw in commits c5970d3ee25b457ad2d78fe6e9662a12dae577cd and dd86461b71ff4a4f5194205896ae5f48f144240d, replacing a fixed 200-byte stack buffer with a length-aware XML API call. The fix changes watcher URI handling so XML nodes are created without inline content and then populated using xmlNodeSetContentLen, preventing long URIs from overflowing the buffer during winfo processing. Organizations running exposed OpenSIPS presence services are advised to upgrade to the fixed releases.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-45809 was newly received by security-advisories@github.com on August 5, 2026. The advisory describes a denial-of-service flaw in OpenSIPS watcherinfo XML generation affecting versions before 3.6.6 and 4.0.0-rc1.
On May 13, 2026, OpenSIPS committed fixes for an XML overflow caused by long watcher URIs in presence.winfo generation. The patches removed a fixed-size 200-byte stack buffer in create_winfo_xml and switched to a length-aware XML API in both the 3.6 and 4.0 code lines.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSIPS disclosed **CVE-2026-45100**, a critical remotely exploitable buffer overflow in the `{s.b64encode}` string transformation affecting versions **3.4.0-beta through 3.6.5** and **4.0.0-beta**. The flaw stems from validating only the pre-encoding input against a 64 KB buffer, even though Base64 expansion can increase output size enough to overflow the buffer by up to **21,844 bytes**. An attacker can trigger the issue by sending a SIP message with a very large header value when an OpenSIPS routing script applies `{s.b64encode}` to attacker-controlled data. The overflow can corrupt adjacent transformation buffers and alter values used by later transformations processing the same SIP message, creating integrity and availability risk. OpenSIPS addressed the issue through code changes that enforce stricter bounds checks on input-derived lengths and related parsing logic across the codebase, including Base64 encoding and other buffer-sensitive components. The vendor fixed the vulnerability in **OpenSIPS 3.6.6** and **4.0.0-rc1**; the flaw is tracked as **CWE-120** and carries a **CVSS 9.1** rating.
Aug 5, 2026
OpenSIPS disclosed **CVE-2026-46334**, a remotely triggerable denial-of-service flaw in SDP bandwidth-line parsing that affects versions prior to **3.6.6** and **4.0.0-rc1**. A malformed session-level `b=` SDP line missing the required `:` delimiter can corrupt parsed bandwidth metadata, and if that corrupted SDP state is later cloned during dialog handling or QoS processing, an OpenSIPS worker process can crash. The issue is exploitable by an unauthenticated attacker in deployments that parse attacker-controlled SDP and use affected routing or module logic. The fix was introduced through OpenSIPS commits that harden `parser/sdp/sdp_helpr_funcs.c` by rejecting malformed bandwidth lines, adding boundary checks, and preventing unsafe access when `b=` appears at the start of the buffer or lacks a separator. The patched code logs an error and returns failure for invalid SDP bandwidth encoding, closing the crash path in both the **3.6** and **4.0.0** code lines. The vulnerability is mapped to **CWE-20** and **CWE-476** and carries high availability impact.
Aug 5, 2026
Wireshark disclosed and fixed **CVE-2026-15167**, a heap buffer overflow in the DBS Etherwatch capture file parser that can be triggered by opening a crafted packet trace file. The flaw was reported in `wiretap/dbs-etherwatch.c`, where bytes from a textual hex dump were written into a record buffer without per-write bounds checks, allowing attacker-controlled data to be written past a heap allocation. The issue was reproduced deterministically with AddressSanitizer and was considered especially serious for `libwiretap` in headless parsing workflows, while desktop users could also be affected by simply opening a malicious file. According to Wireshark's advisory, the vulnerability can crash the application and cause a denial-of-service condition. Affected releases include **Wireshark 4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and fixes were released in **4.6.7** and **4.4.17**. The original issue was tracked in GitLab and later closed after the fix was merged, and Wireshark credited **Nguyen Huu Trung** with discovering the bug while noting that no public exploits were known at the time of disclosure.
Aug 21, 2026