CVE-2026-58268

Name of the Vulnerable Software and Affected Versions SIPGO versions prior to 1.4.1

Description An unauthenticated peer can cause a denial of service by sending a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length. The ParserStream.parseSingle() function in sip/parser stream.go allocates a SIP body buffer based on the client-controlled Content-Length header before the ParseMaxMessageLength limit is enforced. This allows an attacker to trigger excessive memory allocation before the message body is actually read.

Recommendations Update to version 1.4.1.