CVE-2026-45100

Name of the Vulnerable Software and Affected Versions OpenSIPS versions 3.4.0-beta through 3.6.5 OpenSIPS version 4.0.0-beta

Description A buffer overflow exists in the {s.b64encode} string transformation. The size check only verifies that the input fits within the 64 KB transformation buffer, failing to account for the fact that base64 encoding expands data by approximately one third. Consequently, inputs between 49,153 and 65,535 bytes can overflow the buffer by up to 21,844 bytes. Since these buffers are adjacent in memory and reused for chained transformations, the overflow allows attacker-controlled data to corrupt values used by subsequent transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (approximately 50,000 bytes or more) if the routing script applies {s.b64encode} to the input.

Recommendations Update versions 3.4.0-beta through 3.6.5 to version 3.6.6. Update version 4.0.0-beta to version 4.0.0-rc1. As a temporary workaround, restrict the use of the {s.b64encode} transformation on attacker-controlled input within the routing script.