p PatchFirst

CVE-2026-110679

CVE-2026-110679 · OpenSIPS rtpproxy rtpproxy_answer out-of-bounds

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.

CVSS 6.9 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • opensips

    Versions
    • 3.6.0: Affected
    • 3.6.1: Affected
    • 3.6.2: Affected
    • 3.6.3: Affected
    • 3.6.4: Affected
    • 3.6.5: Affected
    • 3.6.6: Affected
    • 3.6.7: Affected
    • 3.6.8: Affected
    • 4.0.0: Affected
    • 4.0.1: Affected
    • 3.6.9: Not affected
    • 4.0.2: Not affected

    No fix published

  • opensips Ubuntu:18.04:LTS

    Versions
    • 2.2.2-3build2
    • 2.2.2-3build3
    • 2.2.2-3build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →