CVE-2026-45537 OpenSIPS CVE debrief

Who should care

OpenSIPS users and administrators, as well as organizations using OpenSIPS for SIP routing, should be aware of this vulnerability and take steps to mitigate it. This includes applying patches or updates to OpenSIPS versions 3.6.6 or 4.0.0-rc1 or later, restricting access to sensitive areas of the OpenSIPS server, and monitoring OpenSIPS server logs for suspicious activity. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the potential impact on their systems and networks. Operators of OpenSIPS servers should also review their configurations and ensure that they are not exposed to untrusted networks or users. Furthermore, organizations using OpenSIPS for SIP routing should consider implementing compensating controls, such as monitoring and detection systems, to help identify and respond to potential attacks. Asset inventory and rollback/change windows should also be reviewed to ensure that affected systems can be quickly identified and remediated. Source tracking and exposure review should also be performed to ensure that the vulnerability is properly understood and addressed. Finally, defenders should verify that their systems are not vulnerable and that patches have been applied correctly. This may involve reviewing system logs, monitoring network traffic, and performing vulnerability scans. By taking these steps, OpenSIPS users and administrators can help protect their systems and networks from potential attacks exploiting this vulnerability. The vulnerability is a buffer overflow in the construct_uri() function, which can be used to corrupt adjacent global data, including the disable_503_translation flag, which controls SIP 503 response handling. This can allow an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. The vulnerability is considered CRITICAL due to its potential impact on OpenSIPS servers and the ease with which it can be exploited. Therefore, it is essential that OpenSIPS users and administrators take immediate action to mitigate this vulnerability and protect their systems and networks from potential attacks. A

Technical summary

The construct_uri() function in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 has a buffer overflow vulnerability. The function concatenates multiple URI components into a fixed 1024-byte global BSS buffer without bounds checking. An attacker-controlled username can cause a combined component length exceeding 1024 bytes, overflowing the buffer and corrupting adjacent global data, including the disable_503_translation flag, which controls SIP 503 response handling.

Defensive priority

OpenSIPS users should prioritize patching to prevent potential remote code execution and routing manipulation.

Recommended defensive actions

• Apply patches or updates to OpenSIPS versions 3.6.6 or 4.0.0-rc1 or later
• Restrict access to sensitive areas of the OpenSIPS server
• Monitor OpenSIPS server logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The construct_uri() function in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 has a buffer overflow vulnerability. The function concatenates multiple URI components into a fixed 1024-byte global BSS buffer without bounds checking. An attacker-controlled username can cause a combined component length exceeding 1024 bytes, overflowing the buffer and corrupting adjacent global data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.