Tags › Denial of Service

OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state

• CVSS v4.0, Enable Security assessment
  • Vector: link
• Other references:
  • CVE-2026-45084
  • GHSA-h3ww-hchh-x2g9
  • CWE-476: NULL Pointer Dereference
• Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after the May 2026 fix series
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-01-opensips-presence-publish-content-type-dos/
• Tested vulnerable version: OpenSIPS 3.5.9
• Timeline:
  • Enable Security reproduced the issue: 2026-04-24
  • UDP/TCP retest: 2026-04-30
  • OpenSIPS advisory: 2026-05-21
  • Enable Security advisory: 2026-05-21

Description

OpenSIPS published GHSA-h3ww-hchh-x2g9 for a configuration-dependent crash in modules/presence/publish.c:handle_publish(). The vulnerable path calls get_content_type(msg) while sphere checking is enabled, but can reach that call without safe Content-Type parser state.

OpenSIPS: Watcherinfo XML generation denial of service from oversized watcher URI

• CVSS v4.0, Enable Security assessment
  • Vector: link
• Other references:
  • CVE-2026-45809
  • GHSA-gx83-2gh8-7v56
  • CWE-121: Stack-based Buffer Overflow
• Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after eeb331cd5
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-02-opensips-watcherinfo-uri-stack-buffer-overflow/
• Tested vulnerable version: OpenSIPS 3.5.9
• Timeline:
  • Enable Security reproduced the issue: 2026-04-29
  • OpenSIPS advisory: 2026-05-21
  • Enable Security advisory: 2026-05-21

Description

OpenSIPS published GHSA-gx83-2gh8-7v56 for a denial-of-service vulnerability in watcherinfo XML generation. The issue is caused by an oversized watcher URI being copied into a fixed-size stack buffer in modules/presence/notify.c:create_winfo_xml().

OpenSIPS: Denial of service in SDP bandwidth parsing via QoS SDP cloning

• CVSS v4.0, Enable Security assessment
  • Vector: link
• Other references:
  • CVE-2026-46334
  • GHSA-rh36-mhpv-cx2r
  • CWE-787: Out-of-bounds Write
• Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after 38d0e6ea0
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-03-opensips-sdp-bandwidth-parsing-dos/
• Tested vulnerable version: OpenSIPS 3.5.9
• Timeline:
  • Enable Security reproduced the issue: 2026-04-29
  • OpenSIPS advisory: 2026-05-21
  • Enable Security advisory: 2026-05-21

Description

OpenSIPS published GHSA-rh36-mhpv-cx2r for malformed SDP bandwidth-line handling in parser/sdp/sdp_helpr_funcs.c:extract_bwidth(). A missing delimiter can corrupt parsed SDP metadata, which can later crash OpenSIPS when the state is cloned by dialog/QoS handling.

OpenSIPS: Denial of service in IMC #list member listing

• CVSS v4.0, Enable Security assessment
  • Vector: link
• Other references:
  • GHSA-3qr5-cgpj-hxhx
  • CWE-787: Out-of-bounds Write
• CVE: not assigned in the OpenSIPS GitHub advisory as of 2026-06-02
• Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after 76afe3420
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-04-opensips-imc-list-buffer-overflow/
• Tested vulnerable version: OpenSIPS 3.5.9
• Timeline:
  • Enable Security reproduced the issue: 2026-04-30
  • Additional verification: 2026-05-15
  • OpenSIPS advisory: 2026-05-21
  • Enable Security advisory: 2026-05-21

Description

OpenSIPS published GHSA-3qr5-cgpj-hxhx for an unchecked fixed-buffer copy in modules/imc/imc_cmd.c:imc_handle_list() while building an IMC room member list reply.

SIPGO: Response DoS vulnerability via nil pointer dereference

• CVSS v4.0
  • Exploitability: High
  • Complexity: Low
  • Vulnerable system: High
  • Subsequent system: None
  • Exploitation: High
  • Security requirements: High
  • Vector: link
• Other references:
  • CVE-2025-68274
  • GHSA-c623-f998-8hhv
  • CWE-476: NULL Pointer Dereference
  • CWE-755: Improper Handling of Exceptional Conditions
• Fixed versions: >= v1.0.0-alpha-1
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-02-sipgo-response-dos/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-02-sipgo-response-dos
• Tested vulnerable versions: >= v0.3.0, < v1.0.0-alpha-1
• Timeline:
  • First discovery: 2025-08-31
  • Root cause analysis: 2025-08-31
  • Fix developed: 2025-08-31
  • Regression tests created: 2025-08-31
  • Enable Security advisory: 2025-12-17

Description

A nil pointer dereference vulnerability was discovered in the SIPGO library’s NewResponseFromRequest function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header.

Sandro talks RTC Security with Safety Detectives

Our CEO discusses why generic security tools fail for voice protocols, how ESAP addresses RTC-specific vulnerabilities, and emerging AI threats in real-time communications.…

Rtpengine RTP Injection and Media Bleed Vulnerabilities (CVE-2025-53399)

We published a critical security advisory for rtpengine affecting versions mr13.3.1.4 and lower, allowing RTP injection and media redirection attacks. These vulnerabilities can be exploited without man-in-the-middle positioning and affect both plaintext RTP and encrypted SRTP sessions. Organizations should upgrade to mr13.4.1.1 and review configuration settings.…

New White Paper: DTLS “ClientHello” Race Conditions in WebRTC Implementations

Our white paper on DTLS ClientHello race conditions in WebRTC reveals vulnerabilities in RTPEngine, Asterisk, FreeSWITCH, and Skype. We tested platforms including Janus, Discord, Google Meet, and Zoom, and provide mitigation strategies for secure real-time communication.…

A Novel DoS Vulnerability affecting WebRTC Media Servers

Executive summary (TL;DR)

A critical denial-of-service (DoS) vulnerability has been identified in media servers that process WebRTC’s DTLS-SRTP, specifically in their handling of ClientHello messages. This vulnerability arises from a race condition between ICE and DTLS traffic and can be exploited to disrupt media sessions, compromising the availability of real-time communication services. Mitigations include filtering packets based on ICE-validated IP and port combinations. The article also indicates safe testing methods and strategies for detecting the attack.

FreeSWITCH: denial of service via DTLS Hello packets during call initiation

• Fixed versions: 1.10.11
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-02-freeswitch-dtls-hello-race/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6
• Other references: CVE-2023-51443
• Tested vulnerable versions: 1.10.10
• Timeline:
  • Report date: 2023-09-27
  • Triaged: 2023-09-27
  • Fix provided for testing: 2023-09-29
  • Vendor release with fix: 2023-12-22
  • Enable Security advisory: 2023-12-22

TL;DR

When handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack.