Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes triggers a stack buffer overflow in which both the length and content of the overwrite are attacker-controlled, corrupting the saved frame pointer and return address. A single unauthenticated UDP packet to the SIP port (5060) can crash the process or, on builds without stack protections, hijack the return address to achieve remote code execution. This affects deployments whose routing script invokes sip_to_json(). This issue was not fixed at the time of publication.
OpenSIPS in Fedora is not affected — every active branch already carries the fix: - rawhide/f45: opensips-4.0.0-9.fc45 - f44: opensips-3.6.7-1.fc44 (built 2026-06-24) - f43: opensips-3.6.7-1.fc43 (built 2026-06-24) There are no EPEL branches for this package, so the above is the full scope of [fedora-all]. Two corrections to the flaw description, both verified against upstream git: 1. This issue was fixed before publication. The fix is commit 4d23613b6 ("core: enforce bounds checks on input-derived lengths (#3888)", 2026-05-13), which adds an "it->name.len >= sizeof(hdr_name_buf)" guard before the memcpy in w_sip_to_json(), skipping over-long header names. It was released in 3.6.6 on 2026-05-20. 2. "In versions 4.0.0 and prior" is not accurate — 4.0.0 contains the guard. Checking modules/sipmsgops/sipmsgops.c across tags: 3.6.5 and 4.0.0-beta lack it; 3.6.6, 3.6.7, 4.0.0-rc1, 4.0.0-rc2 and 4.0.0 all have it. The affected range is therefore the same as the other CVEs from this batch: fixed in 3.6.6 and 4.0.0-rc1. Note that 4d23613b6 is the single commit that also fixes CVE-2026-45100, CVE-2026-45103, CVE-2026-45537 and CVE-2026-45705 — the sip_to_json hunk is the fourth of its five bullet points. The guard is sufficient: hdr_name_buf is declared char[255] in all of the above tags, and the check caps the copy at 254 bytes plus the terminating NUL. Closing CURRENTRELEASE.