Bug 2511526 - CVE-2026-45537 opensips: global buffer overflow in construct_uri [fedora-all]
Summary: CVE-2026-45537 opensips: global buffer overflow in construct_uri [fedora-all]
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: opensips
Version: rawhide
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
Assignee: Peter Lemenkov
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["3f2dd2d5-fd49-42dc-9598-a...
Depends On:
Blocks: CVE-2026-45537
TreeView+ depends on / blocked
 
Reported: 2026-08-05 13:34 UTC by Guilherme de Almeida Suckevicz
Modified: 2026-08-05 13:42 UTC (History)
1 user (show)

Fixed In Version: opensips-3.6.7-1.fc43 opensips-3.6.7-1.fc44 opensips-4.0.0-9.fc45
Clone Of:
Environment:
Last Closed: 2026-08-05 13:42:10 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2026-08-05 13:34:04 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

Comment 1 Peter Lemenkov 2026-08-05 13:42:10 UTC
OpenSIPS in Fedora is not affected — every active branch already carries the fix:

- rawhide/f45: opensips-4.0.0-9.fc45
- f44: opensips-3.6.7-1.fc44 (built 2026-06-24)
- f43: opensips-3.6.7-1.fc43 (built 2026-06-24)

There are no EPEL branches for this package, so the above is the full scope of [fedora-all].

Verified against upstream git rather than the advisory version claims. The construct_uri() bounds check was added by 4d23613b6 ("core: enforce bounds checks on input-derived lengths (#3888)"), which sums the protocol, username, domain, port and params lengths in msg_translator.c and rejects the request when the total exceeds MAX_URI_LEN, before anything is written to the shared buffer. git tag --contains places it in 3.6.6 and 3.6.7.

For 4.0.0 the corresponding master-branch commit was rebased, so hash containment is not meaningful there; the fix was instead confirmed by content — the "constructed URI too long" guard is present in msg_translator.c at tag 4.0.0.

Closing CURRENTRELEASE.


Note You need to log in before you can comment on or make changes to this bug.