CVE-2026-46334 OpenSIPS CVE debrief

Who should care

OpenSIPS administrators and users, especially those with configurations that parse attacker-controlled SDP and apply dialog/QoS processing, should be aware of this vulnerability and take steps to mitigate it. They should review their configurations and ensure that they are updated to versions 3.6.6 or 4.0.0-rc1. Additionally, they should monitor OpenSIPS logs for potential crash indicators and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and vulnerability management teams should also be aware of this vulnerability and prioritize updates and mitigations accordingly. Security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Rollback/change windows and source tracking should be considered for exposed systems. Monitoring and detection capabilities should be reviewed to ensure that they can detect potential attacks. Compensating controls should be implemented for exposed systems while remediation is scheduled and verified. Vendor patch guidance should be followed to ensure that updates are applied correctly. Exposure review should be conducted to determine the extent of potential exposure. Asset inventory should be reviewed to ensure that all affected systems are identified and prioritized for updates and mitigations. Source tracking should be implemented to ensure that all affected systems are tracked and updated accordingly.  

Technical summary

OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata, leading to a crash when a route or module clones the corrupted SDP state. This vulnerability can be triggered by an unauthenticated remote attacker, and it can cause a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing.

Defensive priority

OpenSIPS administrators should prioritize updating to versions 3.6.6 or 4.0.0-rc1 to prevent potential crashes.

Recommended defensive actions

• Update OpenSIPS to version 3.6.6 or 4.0.0-rc1
• Review and restrict SDP parsing and dialog/QoS processing configurations
• Monitor OpenSIPS logs for potential crash indicators
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Conduct exposure review to determine the extent of potential exposure
• Implement asset inventory to ensure that all affected systems are identified and prioritized for updates and mitigations
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates a denial of service vulnerability in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. The vulnerability is related to SDP bandwidth-line parsing logic. However, detailed information about affected configurations and specific attack scenarios is limited. OpenSIPS administrators should verify their configurations and ensure that they are not exposed to potential attacks. They should also review their SDP parsing and dialog/QoS processing configurations to prevent potential crashes.

Official resources