Bug 2511529

Summary:	CVE-2026-45705 opensips: OOB read in multipart body boundary parsing [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	opensips	Assignee:	Peter Lemenkov <lemenkov>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	lemenkov
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["70e44a53-362c-4187-9739-8aef16535172"]}
Fixed In Version:	opensips-3.6.7-1.fc43 opensips-3.6.7-1.fc44 opensips-4.0.0-9.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-08-05 13:43:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2511296

Description Guilherme de Almeida Suckevicz 2026-08-05 13:34:20 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

Comment 1 Peter Lemenkov 2026-08-05 13:43:03 UTC

OpenSIPS in Fedora is not affected — every active branch already carries the fix:

- rawhide/f45: opensips-4.0.0-9.fc45
- f44: opensips-3.6.7-1.fc44 (built 2026-06-24)
- f43: opensips-3.6.7-1.fc43 (built 2026-06-24)

There are no EPEL branches for this package, so the above is the full scope of [fedora-all].

Verified against upstream git rather than the advisory version claims. The delimiter bounds check was added by 4d23613b6 ("core: enforce bounds checks on input-derived lengths (#3888)"), which validates the remaining buffer length in parser/parse_body.c — requiring at least 2 + delimiter.len bytes before the boundary comparison — so find_line_delimiter() no longer reads past the end of the body.  git tag --contains places it in 3.6.6 and 3.6.7.

For 4.0.0 the corresponding master-branch commit was rebased, so hash containment is not meaningful there; the fix was instead confirmed by content — the "ensure enough room for the delimiter match" guard is present in parser/parse_body.c at tag 4.0.0.

Closing CURRENTRELEASE.