CVE-2026-45100 OpenSIPS CVE debrief

Who should care

SIP server administrators and developers, OpenSIPS users and deployers, security teams responsible for vulnerability management, and operators of platforms using OpenSIPS for SIP services. These stakeholders should be aware of the potential risks and take immediate action to update affected versions and implement necessary security measures to prevent exploitation.

Why it matters

This CVE requires immediate attention from OpenSIPS administrators and developers due to the potential for remote code execution and disruption of SIP services. Affected versions must be updated to 3.6.6 or 4.0.0-rc1 or later, and input validation should be implemented to prevent exploitation.

• Potential remote code execution via large SIP header values
• Possible disruption of SIP services
• Need for urgent version updates and input validation

Technical summary

The OpenSIPS {s.b64encode} string transformation has a buffer overflow vulnerability due to inadequate size checks, allowing for potential code execution via large SIP header values. This issue arises because the size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third. Consequently, an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. The vulnerability affects OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta. A remote attacker can exploit this by sending a SIP message with a large header value, potentially allowing for  -

Defensive priority

High

Recommended defensive actions

• Review and update OpenSIPS deployments to ensure version 3.6.6 or 4.0.0-rc1 or later is used
• Restrict input to {s.b64encode} to prevent large header values from being processed
• Monitor for and block suspicious SIP traffic
• Implement additional logging and monitoring for SIP traffic
• Conduct a thorough review of the OpenSIPS configuration and routing scripts
• Verify that all necessary security patches are applied and up-to-date
• Consider engaging with the OpenSIPS community or a security expert for guidance on securing the deployment

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its description, CVSS score, and affected versions. OpenSIPS administrators should verify the vulnerability's impact on their deployments, especially if using versions 3.4.0-beta through 3.6.5 and 4.0.0-beta. Evidence from the CVE Program and NVD suggests that immediate attention is required due to the potential for remote code execution and disruption of SIP services. Affected versions must be updated to 3.6.6 or 4.0.0-rc1 or later, and  -

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.