CVE-2026-45100: OpenSIPS Buffer Overflow Vulnerability
TL;DR - Critical OpenSIPS buffer overflow in
{s.b64encode}caused by incorrect size checking. - Affects3.4.0-betathrough3.6.5and4.0.0-beta; upgrade to3.6.6or4.0.0-rc1. - No confirmed in-the-wild exploitation in current public data, but remote trigger conditions make this urgent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-45100 |
| CVSS score | 9.1 |
| Attack vector | Network reachable via SIP traffic under specific routing-script conditions |
| Auth required | Unknown in formal vector data; based on available description, the trigger may be reachable without prior authentication if attacker-controlled SIP input reaches {s.b64encode} |
| Patch available | Yes |
This issue affects OpenSIPS, a SIP server widely used in telecom and VoIP environments. The flaw is a buffer overflow in the {s.b64encode} string transformation. Publicly available technical details indicate that the vulnerable code validates whether the input fits inside a 64 KB transformation buffer, but does not correctly account for the output expansion introduced by base64 encoding.
For defenders, the operational risk is not just the existence of a bug but the trigger path. A remote attacker would need a deployment where large attacker-controlled SIP message content, such as a header value, is passed into {s.b64encode} by the OpenSIPS routing script. If that path exists, this becomes a remotely reachable memory corruption issue in a security-sensitive infrastructure component.
What Is This Vulnerability?
CVE-2026-45100 is a classic out-of-bounds write caused by an output-boundary validation failure. According to the available vulnerability description, OpenSIPS checks whether the original input string can fit within a 64 KB transformation buffer before applying {s.b64encode}. That check is insufficient because base64 encoding increases the output size by roughly one-third.
The practical result is that an input in the approximate range of 49,153 to 65,535 bytes can still pass the size validation but produce encoded output larger than the fixed transformation buffer. NVD states that this can lead to an overflow of up to 21,844 bytes. Because the overwritten data is attacker-controlled, the vulnerability should be treated as a serious memory corruption condition rather than a benign crash bug.
The impact is made worse by how OpenSIPS reuses transformation buffers. NVD notes that these buffers are adjacent in memory and reused for chained transformations on the same SIP message. That means the overflow may corrupt neighboring transformation state and alter values processed later in the request lifecycle. In real deployments, this raises the possibility of denial of service and potentially more severe outcomes depending on memory layout, build options, and runtime behavior.
In short, the root cause is not “base64 is unsafe,” but that the implementation validated the wrong boundary. It checked the pre-encoding size rather than the maximum possible encoded output size. That distinction is exactly what turns normal transformation logic into a critical memory safety flaw.
Technical Notes
A simplified representation of the vulnerable logic would look like this:
if (input_len <= 65535) {
// unsafe assumption: output will also fit
b64encode(input, outbuf);
}
A safer approach would validate the post-encoding maximum before writing:
size_t encoded_len = 4 * ((input_len + 2) / 3);
if (encoded_len > TRANSFORM_BUF_SIZE) {
return ERR_TOO_LARGE;
}
Who Is Affected?
Based on the source-backed data provided, the affected OpenSIPS versions are:
3.4.0-betathrough3.6.54.0.0-beta
The fixed versions are:
3.6.64.0.0-rc1
That version information is the most important immediate triage point for administrators. If you run OpenSIPS on the 3.6 branch and are still on 3.6.5 or earlier within the affected range, you should assume exposure until proven otherwise. If you tested early 4.0 builds and still have 4.0.0-beta in any environment, that version is also listed as affected.
Exposure is configuration-dependent, which matters for risk ranking but not for patch urgency. The bug only becomes reachable when a routing script applies {s.b64encode} to attacker-controlled data. In many SIP deployments, external message fields such as headers, URIs, or routing-related values can be influenced by untrusted senders. If your OpenSIPS script transforms large user-provided values, the practical attack surface may be real.
If you do not know whether your configuration uses {s.b64encode}, assume potential exposure until you review the route script. Security teams should coordinate with voice engineers or platform owners to search both deployed configs and version-controlled routing scripts for that transformation. In the absence of complete runtime visibility, defenders should assume that internet-facing or partner-connected SIP infrastructure is at higher risk than isolated lab systems.
CVSS Score Breakdown
The published base score is 9.1, which places this issue in critical territory. The exact CVSS vector string was not available in the data provided, so it is important not to invent score components. Still, the score magnitude tells defenders this is considered highly severe by the vulnerability source.
From the technical description, several scoring implications are apparent. The attack is network-relevant because the trigger condition involves sending a crafted SIP message to the target service. The flaw is a memory corruption issue with attacker-controlled overwrite into adjacent buffers, which typically drives high impact ratings. Depending on exploitability in a given environment, the likely outcomes include service crash, memory corruption, and possibly more serious control-flow effects.
Because the formal vector string is unavailable here, defenders should not overfit assumptions such as exact privileges required or user interaction requirements. Instead, use the operationally relevant facts: the vulnerable code is reachable over SIP, it processes untrusted input under some configurations, and the issue involves out-of-bounds writing. That combination justifies expedited remediation even without a published full vector breakdown.
A reasonable defender takeaway is this: a 9.1 score attached to a remotely triggerable memory corruption flaw in a SIP infrastructure component should be handled as a priority patching event, especially for exposed edge nodes, SBC-adjacent services, multi-tenant VoIP environments, and carrier-facing systems.
Exploitation Status
At the time of the provided research note, there is no confirmed evidence of active exploitation in the wild from the CISA Known Exploited Vulnerabilities catalog. The CVE is explicitly noted as not present in KEV. That means there is currently no CISA-confirmed active exploitation signal tied to this issue.
There is also no confirmed public proof-of-concept referenced in the provided source set. The available references point to upstream fix commits and a GitHub security advisory, but the research note did not identify a validated public exploit repository or demonstration exploit. That is an important distinction: no confirmed public PoC is not the same as low risk.
Defenders should treat this as publicly described but not publicly weaponized in the provided evidence. The vulnerability details are sufficient for a capable researcher or attacker to understand the bug class and affected transformation path. Because the trigger condition depends on large attacker-controlled SIP content and script behavior, exploit development may require environmental tuning, but the absence of known exploitation should not delay upgrades.
In clear terms:
- Public PoC confirmed? No confirmed public PoC in the provided source set.
- Active exploitation confirmed in the wild? No confirmed evidence from CISA KEV at this time.
- Should defenders act urgently anyway? Yes, because this is a critical remote memory corruption bug in telecom infrastructure.
How to Detect It
Start by identifying whether your OpenSIPS configuration uses the vulnerable transformation on attacker-controlled data. Review route scripts, included config fragments, and any templated logic generated by orchestration systems. Search for {s.b64encode} and then inspect whether the transformed variable originates from SIP headers, URIs, authentication material, custom headers, or message bodies that external senders can influence.
Next, look for oversized SIP messages or unusually large individual header values. The provided vulnerability description specifically calls out a large header value in the rough range of 50,000 bytes or more as a likely trigger condition. Even if exploitation attempts do not succeed, malformed oversized input may cause crashes, parser errors, transformation failures, or abnormal process restarts.
Because exact log signatures are deployment-specific and upstream advisory text was not fully extracted in the source material, defenders should focus on correlated indicators: very large inbound SIP requests, OpenSIPS worker crashes, segmentation faults, core dumps, or errors occurring after receipt of anomalously large headers. If you terminate SIP through proxies or packet capture infrastructure, network telemetry may reveal suspiciously oversized headers before the application logs do.
Technical Notes
Search your configuration for the vulnerable transformation:
grep -R "\{s\.b64encode\}" /etc/opensips /usr/local/etc/opensips 2>/dev/null
Look for oversized SIP headers in packet captures:
tshark -r sip_traffic.pcap -Y 'sip' -T fields -e ip.src -e sip.Method -e sip.msg_hdr \
| awk 'length($0) > 50000'
A rough IDS-style detection concept for abnormally large SIP headers could be:
alert udp any any -> $SIP_SERVERS 5060 (
msg:"Possible OpenSIPS CVE-2026-45100 trigger attempt";
content:"SIP/2.0"; nocase;
dsize:>50000;
sid:4510001; rev:1;
)
Check system logs for crashes or memory faults associated with OpenSIPS:
journalctl -u opensips --since "2026-08-01" | egrep -i "segfault|signal|crash|core|fault"
dmesg | egrep -i "opensips|segfault|general protection|fault"
If you centralize logs in Splunk or a similar SIEM, a starting query could be:
(index=os OR index=app) ("opensips" AND ("segfault" OR "core dumped" OR "signal 11" OR "general protection fault"))
These detections are not exploit confirmation. They are practical hunting starting points to identify potentially exposed configs and suspicious traffic patterns.
Mitigation and Patching
The primary mitigation is to upgrade to a fixed version. Based on the source-backed data, the remediation versions are:
- Upgrade the 3.6 branch to
3.6.6 - Upgrade the 4.0 branch to
4.0.0-rc1
If you are on affected versions 3.4.0-beta through 3.6.5 or 4.0.0-beta, prioritize patching internet-facing and partner-connected SIP nodes first. In telecom environments, patch planning should also account for active call routing windows, redundancy, and failover behavior. Test updated routing logic in a staging environment if you have complex script transformations, but do not allow lengthy validation to become a reason for indefinite delay.
If you cannot immediately upgrade, reduce exposure by removing or avoiding {s.b64encode} on attacker-controlled values wherever possible. Review route scripts to ensure untrusted SIP headers or large payload-derived strings are not sent through that transformation. If business logic requires encoding, enforce strict length limits before invoking the transformation so the encoded result cannot exceed internal buffer constraints. Also consider upstream filtering of abnormally large SIP headers at edge devices, SBCs, or load balancers.
Because no safe workaround text was provided in the upstream material included here, any temporary mitigation should be treated as risk reduction rather than a substitute for patching. If you cannot verify every route path and message source, assume residual risk remains until the software is upgraded.
Technical Notes
Check the installed version:
opensips -V
Example package upgrade flow on Debian/Ubuntu-style systems, if your repository already carries the fixed release:
sudo apt update
sudo apt install --only-upgrade opensips
opensips -V
Example package upgrade flow on RHEL-like systems:
sudo dnf upgrade opensips
opensips -V
If you build from source, upgrade to the fixed release and redeploy according to your normal change process. A generic source-based workflow might look like:
git clone https://github.com/OpenSIPS/opensips.git
cd opensips
git checkout 3.6.6
make all
sudo make install
opensips -V
Temporary config review to identify risky transformation usage:
grep -R -n "\{s\.b64encode\}" /etc/opensips /usr/local/etc/opensips
A defensive script-level mitigation pattern is to reject unexpectedly large header values before transformation. Exact syntax will depend on your route logic, but the operational goal is straightforward: do not pass very large attacker-controlled strings into {s.b64encode} on vulnerable versions.
References
The following references are directly supported by the provided research note and should be used for validation, change review, and incident response tracking.
The NVD entry is the primary public vulnerability record for CVE-2026-45100 and contains the vulnerability description, affected version ranges, fixed versions, and upstream references. It is the best source for defenders who need a canonical identifier and version impact summary.
The OpenSIPS upstream references are also important because they tie the issue to project-maintained remediation artifacts. The GitHub security advisory provides upstream tracking context, while the two referenced commits correspond to the code fixes associated with the issue. Because the extracted research data did not include the full rendered advisory body, teams should review those upstream pages directly during remediation planning.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45100
- OpenSIPS advisory: https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68
- Upstream fix commit: https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb
- Upstream fix commit: https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- OpenSIPS project site: https://www.opensips.org
For practitioners, the bottom line is clear: if you run affected OpenSIPS versions and your routing logic uses {s.b64encode} on untrusted SIP data, this is a high-priority patch. Even without confirmed in-the-wild exploitation, critical remote memory corruption in a SIP control-plane component deserves immediate attention.
For further reading on VoIP security, check out our articles on What is Pass-the-Hash? and What is SQL Injection?.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.