Tags › Security Advisory
OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state
Published on May 21, 2026 in security advisory, CVE-2026-45084, opensips, denial of service
- CVSS v4.0, Enable Security assessment
- Vector: link
- Other references:
- CVE-2026-45084
- GHSA-h3ww-hchh-x2g9
- CWE-476: NULL Pointer Dereference
- Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after the May 2026 fix series
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-01-opensips-presence-publish-content-type-dos/
- Tested vulnerable version: OpenSIPS 3.5.9
- Timeline:
- Enable Security reproduced the issue: 2026-04-24
- UDP/TCP retest: 2026-04-30
- OpenSIPS advisory: 2026-05-21
- Enable Security advisory: 2026-05-21
Description
OpenSIPS published GHSA-h3ww-hchh-x2g9 for a configuration-dependent crash in modules/presence/publish.c:handle_publish(). The vulnerable path calls get_content_type(msg) while sphere checking is enabled, but can reach that call without safe Content-Type parser state.
OpenSIPS: Watcherinfo XML generation denial of service from oversized watcher URI
Published on May 21, 2026 in security advisory, CVE-2026-45809, opensips, denial of service
- CVSS v4.0, Enable Security assessment
- Vector: link
- Other references:
- CVE-2026-45809
- GHSA-gx83-2gh8-7v56
- CWE-121: Stack-based Buffer Overflow
- Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after
eeb331cd5 - Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-02-opensips-watcherinfo-uri-stack-buffer-overflow/
- Tested vulnerable version: OpenSIPS 3.5.9
- Timeline:
- Enable Security reproduced the issue: 2026-04-29
- OpenSIPS advisory: 2026-05-21
- Enable Security advisory: 2026-05-21
Description
OpenSIPS published GHSA-gx83-2gh8-7v56 for a denial-of-service vulnerability in watcherinfo XML generation. The issue is caused by an oversized watcher URI being copied into a fixed-size stack buffer in modules/presence/notify.c:create_winfo_xml().
OpenSIPS: Denial of service in SDP bandwidth parsing via QoS SDP cloning
Published on May 21, 2026 in security advisory, CVE-2026-46334, opensips, denial of service
- CVSS v4.0, Enable Security assessment
- Vector: link
- Other references:
- CVE-2026-46334
- GHSA-rh36-mhpv-cx2r
- CWE-787: Out-of-bounds Write
- Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after
38d0e6ea0 - Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-03-opensips-sdp-bandwidth-parsing-dos/
- Tested vulnerable version: OpenSIPS 3.5.9
- Timeline:
- Enable Security reproduced the issue: 2026-04-29
- OpenSIPS advisory: 2026-05-21
- Enable Security advisory: 2026-05-21
Description
OpenSIPS published GHSA-rh36-mhpv-cx2r for malformed SDP bandwidth-line handling in parser/sdp/sdp_helpr_funcs.c:extract_bwidth(). A missing delimiter can corrupt parsed SDP metadata, which can later crash OpenSIPS when the state is cloned by dialog/QoS handling.
OpenSIPS: Denial of service in IMC #list member listing
Published on May 21, 2026 in security advisory, opensips, denial of service
- CVSS v4.0, Enable Security assessment
- Vector: link
- Other references:
- GHSA-3qr5-cgpj-hxhx
- CWE-787: Out-of-bounds Write
- CVE: not assigned in the OpenSIPS GitHub advisory as of 2026-06-02
- Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after
76afe3420 - Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-04-opensips-imc-list-buffer-overflow/
- Tested vulnerable version: OpenSIPS 3.5.9
- Timeline:
- Enable Security reproduced the issue: 2026-04-30
- Additional verification: 2026-05-15
- OpenSIPS advisory: 2026-05-21
- Enable Security advisory: 2026-05-21
Description
OpenSIPS published GHSA-3qr5-cgpj-hxhx for an unchecked fixed-buffer copy in modules/imc/imc_cmd.c:imc_handle_list() while building an IMC room member list reply.
OpenSIPS: Out-of-bounds read in IMC unknown-command reply building
Published on May 21, 2026 in security advisory, opensips
- CVSS v4.0, Enable Security assessment
- Vector: link
- Other references:
- GHSA-3gfr-36cv-g4fc
- CWE-125: Out-of-bounds Read
- CVE: not assigned in the OpenSIPS GitHub advisory as of 2026-06-02
- Fixed versions: OpenSIPS 3.6.6, OpenSIPS 4.0.0-rc1, and master at or after
07d54dbc9 - Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-05-opensips-imc-unknown-command-oob-read/
- Tested vulnerable version: OpenSIPS 3.5.9
- Timeline:
- Enable Security reproduced the issue: 2026-04-30
- OpenSIPS advisory: 2026-05-21
- Enable Security advisory: 2026-05-21
Description
OpenSIPS published GHSA-3gfr-36cv-g4fc for an IMC unknown-command reply length mismatch in modules/imc/imc_cmd.c:imc_handle_unknown(). The vulnerable code keeps the would-have-been snprintf() length after truncation and passes that oversized length to TM reply construction.
SIPGO: Response DoS vulnerability via nil pointer dereference
Published on Dec 17, 2025 in CVE-2025-68274, sipgo, denial of service, security advisory
- CVSS v4.0
- Exploitability: High
- Complexity: Low
- Vulnerable system: High
- Subsequent system: None
- Exploitation: High
- Security requirements: High
- Vector: link
- Other references:
- CVE-2025-68274
- GHSA-c623-f998-8hhv
- CWE-476: NULL Pointer Dereference
- CWE-755: Improper Handling of Exceptional Conditions
- Fixed versions: >= v1.0.0-alpha-1
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-02-sipgo-response-dos/
- Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-02-sipgo-response-dos
- Tested vulnerable versions: >= v0.3.0, < v1.0.0-alpha-1
- Timeline:
- First discovery: 2025-08-31
- Root cause analysis: 2025-08-31
- Fix developed: 2025-08-31
- Regression tests created: 2025-08-31
- Enable Security advisory: 2025-12-17
Description
A nil pointer dereference vulnerability was discovered in the SIPGO library’s NewResponseFromRequest function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header.
rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration
Published on Jul 31, 2025 in CVE-2025-53399, rtpengine, owasp, security advisory
- CVSS v4.0
- Exploitability: High
- Complexity: Low
- Vulnerable system: Medium
- Subsequent system: Medium
- Exploitation: High
- Security requirements: High
- Vector: link
- Other references: CVE-2025-53399
- Fixed versions: >= mr13.4.1.1
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject/
- Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject
- Tested vulnerable versions: mr13.3.1.4 and lower
- Timeline:
- First report: 2025-04-24
- Triaged: 2025-04-30
- Fix provided for testing: 2025-05-05
- Various back and forth and more fixes: 2025-05 / 2025-06
- Vendor applied all fixes satisfactorily to master branch: 2025-06-05
- Enable Security verified and confirmed fix: 2025-06-26
- Vendor release with fix (mr13.4.1.1): 2025-07-03
- Enable Security advisory: 2025-07-31
Description
Media servers often support source address learning to dynamically adapt to network conditions and client behavior. This is especially useful in scenarios involving NAT where the source IP and port of incoming RTP packets may differ from what was initially signaled via SDP over SIP. However, this mechanism can be exploited for two types of attacks if malicious packets are accepted as legitimate:
…FreeSWITCH: denial of service via DTLS Hello packets during call initiation
Published on Dec 22, 2023 in CVE-2023-51443, freeswitch, denial of service, security advisory
- Fixed versions: 1.10.11
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-02-freeswitch-dtls-hello-race/
- Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6
- Other references: CVE-2023-51443
- Tested vulnerable versions: 1.10.10
- Timeline:
- Report date: 2023-09-27
- Triaged: 2023-09-27
- Fix provided for testing: 2023-09-29
- Vendor release with fix: 2023-12-22
- Enable Security advisory: 2023-12-22
TL;DR
When handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack.
…rtpengine: denial of service via DTLS Hello packets during call initiation
Published on Dec 15, 2023 in CVE-2023-51275, rtpengine, denial of service, security advisory
- Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2, mr9.5.8.2, mr8.5.12.2
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-03-rtpengine-dtls-hello-race/
- Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6
- Other references: CVE-2023-51275
- Tested vulnerable versions: mr11.5.1.6
- Timeline:
- Report date: 2023-10-02
- Triaged: 2023-10-02
- Fix provided for testing: 2023-11-16
- Enable Security verified fix: 2023-12-14
- Vendor release with fix: 2023-12-14
- Enable Security advisory: 2023-12-15
TL;DR
When handling DTLS-SRTP for media setup, RTPEngine is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS encrypted calls during the attack.
…Asterisk: denial of service via DTLS Hello packets during call initiation
Published on Dec 15, 2023 in CVE-2023-49786, asterisk, denial of service, security advisory
- Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-01-asterisk-dtls-hello-race/
- Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
- Other references: CVE-2023-49786
- Tested vulnerable versions: 20.1.0
- Timeline:
- Report date: 2023-09-27
- Triaged: 2023-09-27
- Fix provided for testing: 2023-11-09
- Vendor release with fix: 2023-12-14
- Enable Security advisory: 2023-12-15
TL;DR
When handling DTLS-SRTP for media setup, Asterisk is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack.
…