CVE-2026-45705

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1

Description The find line delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. This occurs when a Session Initiation Protocol (SIP) message uses Content-Type: multipart/mixed with a boundary parameter, and the body contains a -- pattern within two to three bytes of the end without the actual boundary delimiter following it. In such cases, the function compares delimiter.len bytes starting from a position at or beyond the logical end of the body buffer, reading past the boundary.

Recommendations Update to version 3.6.6. Update to version 4.0.0-rc1.