CVE-2026-45537

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1

Description The construct uri() function concatenates URI components including protocol, username, domain, port, and params into a fixed 1024-byte global BSS buffer without bounds checking. An attacker can provide a long username that causes the combined length to exceed 1024 bytes, resulting in a buffer overflow. This allows the corruption of adjacent global data, specifically the disable 503 translation flag, which controls SIP 503 response handling. By manipulating this flag, an attacker can alter the server's routing behavior for subsequent messages. Additionally, because the buffer is shared with contact builder(), the overflow also corrupts data used by that function.

Recommendations Update to version 3.6.6. Update to version 4.0.0-rc1.