CVE-2026-45103

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1

Description The TCP message framing layer parses the Content-Length header using unsigned int arithmetic without overflow checks. An unauthenticated, network-based attacker can send a Content-Length value that overflows the unsigned int, causing the framing layer to compute a wrapped-around value and split the TCP stream at an incorrect boundary. This leads to SIP message smuggling, where the body of the first SIP message is processed as a separate message. This flaw affects any TCP-based transport, including proto tcp, proto tls, proto ws, and proto wss, allowing smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting.

Recommendations Update to version 3.6.6. Update to version 4.0.0-rc1.