CVE-2026-90779 SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
A malicious SIP server can crash the SIPp client via a stack buffer overflow in the authentication header processing logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90779?
CVE-2026-90779 is a high-severity memory corruption vulnerability in sipp, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.
Weakness: CWE-121
Which versions are affected by CVE-2026-90779?
How do I fix CVE-2026-90779?
No fix has been published for CVE-2026-90779 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90779 being exploited?
There is no known exploitation of CVE-2026-90779 in the wild and no public exploit code.
Sources
Also known as GHSA-h494-p5hw-ph93.