CVE-2026-77322

Name of the Vulnerable Software and Affected Versions SIPGO versions prior to 1.4.3

Description An unauthenticated WS or WSS peer can cause a denial of service in the server process. The issue occurs because WSConnection.Read in sip/transport ws.go creates a wsutil.Reader without setting MaxFrameSize, which allows NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An attacker can send a frame header declaring an extremely large payload, leading to an oversized memory allocation or a makeslice length panic, resulting in a server crash or memory exhaustion.

Recommendations Update SIPGO to version 1.4.3.