CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
An attacker can trigger a buffer overflow in OpenSIPS via a long URI username, potentially executing code or altering server routing behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45537?
CVE-2026-45537 is a critical memory corruption vulnerability in opensips, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Weakness: CWE-120
Which versions are affected by CVE-2026-45537?
How do I fix CVE-2026-45537?
No fix has been published for CVE-2026-45537 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-45537 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45537 exists.
Sources
Also known as GHSA-v7h4-fwrc-c66v, UBUNTU-CVE-2026-45537.