Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-45100: OpenSIPS base64 encode can overflow buffer
CVE-2026-45100 · published 3 months ago
Summary
OpenSIPS versions up to 3.6.5 and 4.0.0-beta may write past the end of a memory buffer when the {s.b64encode} function processes a very large SIP header (about 50 KB). This can corrupt nearby data and could be used by a remote attacker to disrupt or manipulate SIP messages. Upgrade to OpenSIPS 3.6.6 or later, or apply the provided patch, to eliminate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| opensips | opensips | >= 3.4.0-beta, < 3.6.6 |
Original advisory text
OpenSIPS: Buffer Overflow in Base64 Encode Transformation
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
References
- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68 Vendor Advisory
- https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a... Patch
- https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba1... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45100... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45100 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-120Classic Buffer Overflow
Timeline
Published4 Aug 2026
Updated31 Oct 2026
First seen4 Aug 2026
Track software like this
Free during beta