CVE-2026-45100
- Source
- https://cve.org/CVERecord?id=CVE-2026-45100
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45100.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45100
- Aliases
-
- GHSA-35fr-6rv9-vp68
- Downstream
- Published
- 2026-08-04T21:41:54Z
- Modified
- 2026-10-21T10:05:08Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- OpenSIPS: Buffer Overflow in Base64 Encode Transformation
- Details
-
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold and overflows it by up to 21,844 bytes. Because these transformation buffers sit next to each other in memory and are reused for chained transformations, the overflow writes attacker-controlled data into the adjacent buffer and corrupts values used by later transformations processing the same SIP message. A remote attacker can trigger this by sending a SIP message with a large header value (roughly 50,000 bytes or more) when the routing script applies {s.b64encode} to attacker-controlled input, making exploitability dependent on the deployment's routing configuration. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-120" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45100.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45100.json
- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-35fr-6rv9-vp68
- https://nvd.nist.gov/vuln/detail/CVE-2026-45100
- https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb
- https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668
Affected packages
Git / github.com/opensips/opensips
Affected ranges
- Type
- GIT
- Repo
- https://github.com/opensips/opensips
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "3.4.0-beta" }, { "fixed": "3.6.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "4.0.0-beta" }, { "fixed": "4.0.0-rc1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "4d23613b65579b073784a07a65d3bf52443a4efb" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5f103effaf5f372cccffe0b138f16998eba12668" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45100.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "226109660663622823631909999628572278192",
"length": 1165
},
"id": "CVE-2026-45100-0268cd07",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "msg_translator.c",
"function": "construct_uri"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"85930018187884512745115767180453856631",
"9123448050024963639918296936378324161",
"92809748590602814031314121294972925619",
"240765678873066602221693786686058347090",
"182194714402083001125852811031434801325",
"210330180258749208161186560082503475195",
"274701893048541175074950407861772541431",
"18787012699178113669500224280464431920",
"205381219874839427522051611470170285208"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-05eaa95d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "parser/parse_body.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"194553780228902367408282060407856839420",
"183826118522500325336916991386153275102",
"23609876740523779741945635475230307575",
"141747783010088878646037041870850259125"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-107957fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "net/proto_tcp/tcp_common.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"85930018187884512745115767180453856631",
"9123448050024963639918296936378324161",
"92809748590602814031314121294972925619",
"240765678873066602221693786686058347090",
"182194714402083001125852811031434801325",
"210330180258749208161186560082503475195",
"274701893048541175074950407861772541431",
"18787012699178113669500224280464431920",
"205381219874839427522051611470170285208"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-122ca185",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "parser/parse_body.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "239673843364076259551748090071822079551",
"length": 571
},
"id": "CVE-2026-45100-129c1a0a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "parser/parse_body.c",
"function": "find_line_delimiter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "239673843364076259551748090071822079551",
"length": 571
},
"id": "CVE-2026-45100-22316bff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "parser/parse_body.c",
"function": "find_line_delimiter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "226109660663622823631909999628572278192",
"length": 1165
},
"id": "CVE-2026-45100-30c936c5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "msg_translator.c",
"function": "construct_uri"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"259792131642235888277525552403952949501",
"19727793969141095193342753458564901510",
"250027361493129396404438022515615142387",
"131530994763376973766044638250629325529"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-45d036bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "transformations.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69285013667388920103612027740108265861",
"length": 5503
},
"id": "CVE-2026-45100-471fb556",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "net/proto_tcp/tcp_common.h",
"function": "tcp_parse_headers"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"194553780228902367408282060407856839420",
"183826118522500325336916991386153275102",
"23609876740523779741945635475230307575",
"141747783010088878646037041870850259125"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-595b96e9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "net/proto_tcp/tcp_common.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"130220909244983205895730861006096440765",
"201398176700919108372473887128474278781",
"121445666154359984419269907102979981103",
"108167142466647012142512874289336928524"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-8e374df9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "modules/sipmsgops/sipmsgops.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19310062195480744222226083625835443064",
"339864232818495752804831665751736944949",
"240018973462300301157123594980096397708",
"269605422026381028125978291213120820099",
"250504334230145485243675626025849081370",
"118179321761923208172555936330597528500",
"315624634716116334899958124016993442152"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-92f2e927",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "msg_translator.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192541007272035597802489654964185552143",
"length": 1822
},
"id": "CVE-2026-45100-a77a39d4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "modules/sipmsgops/sipmsgops.c",
"function": "w_sip_to_json"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"130220909244983205895730861006096440765",
"201398176700919108372473887128474278781",
"121445666154359984419269907102979981103",
"108167142466647012142512874289336928524"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-c40209c2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "modules/sipmsgops/sipmsgops.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "69285013667388920103612027740108265861",
"length": 5503
},
"id": "CVE-2026-45100-cb92d957",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "net/proto_tcp/tcp_common.h",
"function": "tcp_parse_headers"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140898031237516326815696325741558996037",
"length": 20896
},
"id": "CVE-2026-45100-d98f0c26",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "transformations.c",
"function": "tr_eval_string"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19310062195480744222226083625835443064",
"339864232818495752804831665751736944949",
"240018973462300301157123594980096397708",
"269605422026381028125978291213120820099",
"250504334230145485243675626025849081370",
"118179321761923208172555936330597528500",
"315624634716116334899958124016993442152"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-da732c9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "msg_translator.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140898031237516326815696325741558996037",
"length": 20896
},
"id": "CVE-2026-45100-dcf18d16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "transformations.c",
"function": "tr_eval_string"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"259792131642235888277525552403952949501",
"19727793969141095193342753458564901510",
"250027361493129396404438022515615142387",
"131530994763376973766044638250629325529"
],
"threshold": 0.9
},
"id": "CVE-2026-45100-e5c152fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
"target": {
"file": "transformations.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192541007272035597802489654964185552143",
"length": 1822
},
"id": "CVE-2026-45100-f2117fac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
"target": {
"file": "modules/sipmsgops/sipmsgops.c",
"function": "w_sip_to_json"
}
}
]
vanir_signatures_modified
"2026-10-21T10:05:08Z"