Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
OpenSIPS in Fedora is not affected — every active branch already carries the fix: - rawhide/f45: opensips-4.0.0-9.fc45 - f44: opensips-3.6.7-1.fc44 (built 2026-06-24) - f43: opensips-3.6.7-1.fc43 (built 2026-06-24) There are no EPEL branches for this package, so the above is the full scope of [fedora-all]. Verified against upstream git rather than the advisory version claims. The delimiter bounds check was added by 4d23613b6 ("core: enforce bounds checks on input-derived lengths (#3888)"), which validates the remaining buffer length in parser/parse_body.c — requiring at least 2 + delimiter.len bytes before the boundary comparison — so find_line_delimiter() no longer reads past the end of the body. git tag --contains places it in 3.6.6 and 3.6.7. For 4.0.0 the corresponding master-branch commit was rebased, so hash containment is not meaningful there; the fix was instead confirmed by content — the "ensure enough room for the delimiter match" guard is present in parser/parse_body.c at tag 4.0.0. Closing CURRENTRELEASE.