CVE-2026-45809 OpenSIPS CVE debrief

Who should care

Defenders responsible for OpenSIPS deployments, particularly those exposing handle_subscribe() and allowing watcherinfo (presence.winfo) generation, should assess exposure and prioritize patching to prevent potential crashes.

Why it matters

Defenders should care about CVE-2026-45809 because it affects OpenSIPS deployments, potentially allowing remote attackers to crash OpenSIPS workers. Configurations exposing handle_subscribe() and allowing watcherinfo (presence.winfo) generation are at risk. Defenders should verify configurations, assess exposure, and prioritize patching to prevent exploitation.

• Potential crashes of OpenSIPS workers due to denial of service vulnerability.
• Need to verify OpenSIPS configurations and assess exposure.
• Prioritize patching to prevent exploitation.
• Monitor logs for potential crashes and implement compensating controls.

Technical summary

OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. The issue is configuration-dependent and requires the presence and presence_xml modules to be loaded and SUBSCRIBE routing to be reachable.

Defensive priority

Defenders should prioritize verifying OpenSIPS configurations, assessing exposure, and applying patches to prevent potential crashes.

Recommended defensive actions

• Verify OpenSIPS configurations to ensure handle_subscribe() and watcherinfo (presence.winfo) generation are not exposed unnecessarily.
• Assess exposure and apply patches to OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1.
• Monitor OpenSIPS logs for potential crashes and implement compensating controls to prevent exploitation.
• Review OpenSIPS configurations for compliance with security best practices.
• Perform vulnerability scanning to identify potentially affected systems.
• Implement additional monitoring and logging to detect potential attacks.
• Coordinate with OpenSIPS vendors for support and guidance on patching and mitigation.

Evidence notes

The vulnerability is configuration-dependent and requires the presence and presence_xml modules to be loaded and SUBSCRIBE routing to be reachable. Defenders should verify OpenSIPS configurations, assess exposure, and prioritize patching to prevent potential crashes. The issue has been fixed in versions 3.6.6 and 4.0.0-rc1. Evidence is limited to public sources and may not cover all potential attack vectors or affected configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.