Tags › CVE-2026-46334

OpenSIPS: Denial of service in SDP bandwidth parsing via QoS SDP cloning

• CVSS v4.0, Enable Security assessment
  • Vector: link
• Other references:
  • CVE-2026-46334
  • GHSA-rh36-mhpv-cx2r
  • CWE-787: Out-of-bounds Write
• Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after 38d0e6ea0
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-03-opensips-sdp-bandwidth-parsing-dos/
• Tested vulnerable version: OpenSIPS 3.5.9
• Timeline:
  • Enable Security reproduced the issue: 2026-04-29
  • OpenSIPS advisory: 2026-05-21
  • Enable Security advisory: 2026-05-21

Description

OpenSIPS published GHSA-rh36-mhpv-cx2r for malformed SDP bandwidth-line handling in parser/sdp/sdp_helpr_funcs.c:extract_bwidth(). A missing delimiter can corrupt parsed SDP metadata, which can later crash OpenSIPS when the state is cloned by dialog/QoS handling.