PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45809 OpenSIPS CVE debrief

The CVE-2026-45809 vulnerability is a denial of service issue in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1, affecting deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, triggering presence.winfo watcherinfo XML generation and crashing the OpenSIPS process. This issue requires configuration-dependent conditions to be met, including the presence and presence_xml modules being loaded and SUBSCRIBE routing being reachable. OpenSIPS administrators and users should be aware of this vulnerability and take steps to mitigate it, particularly in environments where handle_subscribe() and watcherinfo generation are exposed.

Vendor
OpenSIPS
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

OpenSIPS administrators and users, particularly those with deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

CVE-2026-45809 is a denial of service vulnerability in the watcherinfo generation functionality of OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, triggering presence.winfo watcherinfo XML generation and crashing the OpenSIPS process. The vulnerability requires configuration-dependent conditions to be met, including the presence and presence_xml modules being loaded and SUBSCRIBE routing being reachable.

Defensive priority

OpenSIPS deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation should prioritize patching to prevent potential crashes.

Recommended defensive actions

  • Inventory OpenSIPS deployments for exposure to handle_subscribe() and watcherinfo (presence.winfo) generation.
  • Apply patches or upgrades to OpenSIPS versions 3.6.6 or 4.0.0-rc1 or later.
  • Monitor OpenSIPS logs for potential crashes or anomalies in presence.winfo watcherinfo XML generation.
  • Consider compensating controls such as rate limiting or IP blocking for affected deployments.
  • Review OpenSIPS configuration to ensure presence and presence_xml modules are not unnecessarily loaded.
  • Verify that SUBSCRIBE routing is properly restricted to prevent unauthorized access.
  • Track and analyze OpenSIPS performance metrics to detect potential issues early.

Evidence notes

The CVE-2026-45809 issue arises in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1, where a remote attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, triggering a crash in the presence.winfo watcherinfo XML generation. The vulnerability requires the presence and presence_xml modules to be loaded and SUBSCRIBE routing to be reachable.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T00:17:00.030Z and has not been modified since then.