CVE-2026-45809 OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI
Remote attackers can crash OpenSIPS workers via stack buffer overflow in watcherinfo XML generation when presence modules are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45809?
CVE-2026-45809 is a high-severity memory corruption vulnerability in opensips, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Weakness: CWE-121
Which versions are affected by CVE-2026-45809?
How do I fix CVE-2026-45809?
No fix has been published for CVE-2026-45809 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-45809 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45809 exists.
Sources
Also known as GHSA-gx83-2gh8-7v56, UBUNTU-CVE-2026-45809.