Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
OpenSIPS in Fedora is not affected — every active branch already carries the fix: - rawhide/f45: opensips-4.0.0-9.fc45 - f44: opensips-3.6.7-1.fc44 (built 2026-06-24) - f43: opensips-3.6.7-1.fc43 (built 2026-06-24) There are no EPEL branches for this package, so the above is the full scope of [fedora-all]. Verified against upstream git rather than the advisory version claims. The fix is 8fe74b01f ("sdp: reject malformed bandwidth lines") in parser/sdp/sdp_helpr_funcs.c, which parses the b= line into a local str before splitting on the colon and bails out when the delimiter is absent, instead of leaving bwtype pointing at a partially parsed line for a later clone to trip over. git tag --contains places it in 3.6.6 and 3.6.7. For 4.0.0 the corresponding master-branch commit was rebased, so hash containment is not meaningful there; the fix was instead confirmed by content — extract_bwidth() in parser/sdp/sdp_helpr_funcs.c at tag 4.0.0 carries the local bline handling. Closing CURRENTRELEASE.