External risk intelligence

OpenSIPS SIP Server Stack Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-45538

OpenSIPS is a SIP server designed to process traffic on public-facing network ports (default 5060). The vulnerability is reachable via a single unauthenticated UDP packet directly to this service, which is commonly deployed at the network edge to facilitate internet-based voice and signaling communications.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpenSIPS, a system for managing voice and signaling communications, could allow an attacker to crash the service or potentially execute malicious code remotely. This occurs when processing certain malformed network messages, specifically those with unusually long header names, if the system's routing script invokes a specific function to convert these messages. While the impact depends on how OpenSIPS is configured and used, the underlying technical flaw allows for significant system compromise.

Malformed messages can crash or hijack systems.
Affects systems processing voice and signaling traffic.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted SIP message containing a header name that is excessively long. This message is sent to the OpenSIPS server's default UDP port. When the server attempts to process this message using a function designed to convert SIP information to JSON, it fails to check the size of the header name. This oversight allows the oversized header name to overwrite critical data on the server's memory stack, potentially leading to a server crash or remote code execution.

Unauthenticated UDP packet to SIP port.
SIP message with oversized header name.
Denial of service or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A malicious actor could crash an OpenSIPS server or potentially execute arbitrary code by sending a specially crafted SIP message with an overly long header name. This could impact the availability and integrity of communication services when the `sip_to_json()` function is used in the routing script.

Server availability and integrity at risk.
Triggered by crafted SIP message over UDP.
Service disruption or remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and potentially infrastructure or platform teams responsible for managing the OpenSIPS server are likely to be involved. The first practical step is to identify all OpenSIPS instances, determine if they are exposed to the network and process external traffic, and locate the specific routing scripts that invoke the `sip_to_json()` function. This will help prioritize remediation efforts based on actual risk and exposure.

Ownership: Infrastructure or Platform teams managing OpenSIPS.
Verify first: Identify exposed instances and `sip_to_json()` usage.
Action: Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenSIPS and how is it used?

OpenSIPS is a high-performance server used to manage Session Initiation Protocol (SIP) traffic. It acts as a communication hub, routing calls and signaling messages for voice, video, and instant messaging services in both telecommunications and enterprise environments.

What does CVE-2026-45538 mean for my software?

This vulnerability is a stack-based buffer overflow (CWE-121). It happens when the server tries to process a SIP header name that is longer than the 255-byte limit allocated in memory. Because the system fails to check the input size before copying it, the extra data overwrites adjacent memory, which can crash the service or allow an attacker to run unauthorized code.

How is this vulnerability triggered?

An attacker triggers this by sending a single, unauthenticated UDP packet containing a malformed SIP message with an excessively long header name to port 5060. Critically, the bug is only activated if your specific OpenSIPS routing script calls the sip_to_json() function; if your scripts do not use this function, the vulnerable code path is not reached.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high level of relevance because OpenSIPS is typically deployed at the network edge to handle public-facing traffic. Since this flaw is reachable via a single unauthenticated UDP packet over the internet, servers exposed to the public network are at the greatest risk of exploitation.

What should I do to respond to this threat?

First, conduct an audit of your infrastructure to identify all running OpenSIPS instances. Next, inspect your configuration and routing scripts to determine if they invoke the sip_to_json() function. If you find this function in use, prioritize those systems for monitoring or protective measures while awaiting a formal patch.

References

github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.