{"kind": "product", "path": "vulns/ubuntu-18.04-lts/opensips", "name": "opensips", "product": "opensips", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2026-110679", "noindex": false, "published": "2026-10-14T20:30:20.592Z", "modified": "2026-10-15T15:27:12.475Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "severity": "medium", "epss": 0.00307, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110679", "title": "OpenSIPS rtpproxy rtpproxy_answer out-of-bounds", "description": "A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.", "references": ["https://vuldb.com/vuln/419834", "https://vuldb.com/vuln/419834/cti", "https://vuldb.com/cve/CVE-2026-110679"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-46334", "noindex": false, "published": "2026-08-04T23:50:57.147Z", "modified": "2026-08-05T14:28:03.200Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00666, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46334", "title": "OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-rh36-mhpv-cx2r", "https://github.com/OpenSIPS/opensips/commit/8fe74b01f6fbf86c0b5e290735275530cb65e0fb", "https://github.com/OpenSIPS/opensips/commit/ac5309d5b8206cd3dbe1b4e01567c8db1ce31444"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45809", "noindex": false, "published": "2026-08-04T23:30:03.111Z", "modified": "2026-08-05T13:57:39.468Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00637, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45809", "title": "OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generat", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-gx83-2gh8-7v56", "https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd", "https://github.com/OpenSIPS/opensips/commit/dd86461b71ff4a4f5194205896ae5f48f144240d"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45705", "noindex": false, "published": "2026-08-04T23:16:31.543Z", "modified": "2026-08-05T13:39:43.972Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45705", "title": "OpenSIPS: OOB Read in Multipart Body Boundary Parsing", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end w", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-chxf-9368-fqcp", "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb", "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45537", "noindex": false, "published": "2026-08-04T22:48:43.580Z", "modified": "2026-08-05T17:48:44.922Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "severity": "critical", "epss": 0.00626, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45537", "title": "OpenSIPS: Global Buffer Overflow in construct_uri", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministicall", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v", "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb", "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45103", "noindex": false, "published": "2026-08-04T21:56:57.422Z", "modified": "2026-08-05T17:55:45.043Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00585, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45103", "title": "OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, ne", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh", "https://github.com/OpenSIPS/opensips/commit/4d23613b", "https://github.com/OpenSIPS/opensips/commit/5f103eff"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45100", "noindex": false, "published": "2026-08-04T21:41:54.584Z", "modified": "2026-08-05T14:01:56.709Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "severity": "critical", "epss": 0.00834, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45100", "title": "OpenSIPS: Buffer Overflow in Base64 Encode Transformation", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data i", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68", "https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb", "https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45084", "noindex": false, "published": "2026-08-04T21:23:21.106Z", "modified": "2026-08-05T14:16:11.377Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00655, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45084", "title": "OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a conte", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-h3ww-hchh-x2g9", "https://nvd.nist.gov/vuln/detail/CVE-2026-45084"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-45538", "noindex": false, "published": "2026-08-04T20:47:10.262Z", "modified": "2026-08-05T14:28:49.526Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00802, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45538", "title": "OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copy", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. Function sip_to_json() (modules/sipmsgops/sipmsgops.c) copies SIP header names into a fixed 255-byte stack buffer without bounds checking, performing a memcpy of the full header-name length even though the SIP parser imposes no such limit (a header name can be roughly 65000 bytes). As a result, when a routing script calls sip_to_json(), a SIP message with a header name longer than 255 bytes trigger", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3", "https://nvd.nist.gov/vuln/detail/CVE-2026-45538"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-25554", "noindex": false, "published": "2026-02-25T16:54:11.845Z", "modified": "2026-07-14T15:53:41.151Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00364, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-25554", "title": "OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass", "description": "OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL query. An attacker can supply a crafted JWT with a malicious tag claim to manipulate the query result and bypass JWT authentication, allowing impersonation of arbitrary identities.", "references": ["https://opensips.org/pub/opensips/3.6.4/ChangeLog", "https://github.com/OpenSIPS/opensips/pull/3807", "https://github.com/OpenSIPS/opensips/commit/3822d33c1c6b25832fdd88da1d23eed74be55b05"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-28099", "noindex": false, "published": "2023-03-15T22:16:57.958Z", "modified": "2025-02-25T14:56:03.865Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00905, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28099", "title": "OpenSIPS has vulnerability in the ds_is_in_list() function", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash.  All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known wor", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3", "https://github.com/OpenSIPS/opensips/issues/2780", "https://github.com/OpenSIPS/opensips/commit/e2f13d374"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-28098", "noindex": false, "published": "2023-03-15T22:11:01.323Z", "modified": "2025-02-25T14:56:10.861Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00905, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28098", "title": "OpenSIPS has vulnerability in the Digest Authentication Parser", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing\nfunctions that make use of the affected code, such as", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h", "https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-28097", "noindex": false, "published": "2023-03-15T22:03:41.362Z", "modified": "2025-02-25T14:56:16.155Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00969, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28097", "title": "OpenSIPS has vulnerability in the Content-Length Parser", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq", "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-28096", "noindex": false, "published": "2023-03-15T21:52:00.194Z", "modified": "2025-02-25T14:56:23.444Z", "cvss": 4.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00767, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28096", "title": "OpenSIPS has memory leak in cJSON lib", "description": "OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{\"jsonrpc\": \"2.0\",\"method\": \"log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.\n\nTo abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr", "https://github.com/OpenSIPS/opensips/commit/417568707520af25ec5c5dd91da18e6db3649dcb", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-28095", "noindex": false, "published": "2023-03-15T21:43:10.408Z", "modified": "2025-02-25T14:56:28.982Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00969, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-28095", "title": "OpenSIPS has vulnerability in the building the local negative replies", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been ", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h", "https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-27601", "noindex": false, "published": "2023-03-15T21:32:56.061Z", "modified": "2025-02-25T14:56:36.328Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0099, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27601", "title": "OpenSIPS has vulnerability in the codec_delete_XX() functions", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `code", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h", "https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf", "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-27600", "noindex": false, "published": "2023-03-15T21:14:33.131Z", "modified": "2025-02-25T14:56:44.542Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0099, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27600", "title": "OpenSIPS has vulnerability in the codec_delete_XX() functions", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `code", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx", "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100", "https://opensips.org/docs/modules/3.3.x/sipmsgops.html"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-27599", "noindex": false, "published": "2023-03-15T20:58:06.736Z", "modified": "2025-02-25T14:56:53.351Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00971, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27599", "title": "OpenSIPS has vulnerability in the parse_to_param() function", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4.", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qvj2-vqrg-f5jx", "https://github.com/OpenSIPS/opensips/commit/cb56694d290530ac308f44b453c18120b1c1109d", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-27598", "noindex": false, "published": "2023-03-15T20:29:49.673Z", "modified": "2025-02-25T14:57:06.043Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00971, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27598", "title": "OpenSIPS has vulnerability in the parse_via() function", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long ", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx", "https://github.com/OpenSIPS/opensips/commit/ab611f74f69d9c42be5401c40d56ea06a58f5dd7", "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2023-27597", "noindex": false, "published": "2023-03-15T20:17:20.536Z", "modified": "2025-02-25T14:57:11.890Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00738, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-27597", "title": "OpenSIPS has vulnerability in the parse_uri() function", "description": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function `rewrite_ruri`, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations containing functions that make use of the affected code, such as the function `setport`. This issue has been fixed in version 3.1.8 and 3.2.5.", "references": ["https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c", "https://github.com/OpenSIPS/opensips/commit/b2dffe4b5cd81182c9c8eabb6c96aac96c7acfe3", "https://nvd.nist.gov/vuln/detail/CVE-2023-27597"], "fixes": [], "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "opensips", "path": "vulns/ubuntu-18.04-lts/opensips", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-15T15:27:12.475Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}