CVE-2026-45537

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45537

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45537.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45537

Aliases

GHSA-v7h4-fwrc-c66v

Downstream

UBUNTU-CVE-2026-45537

Published

2026-08-04T22:48:43.580Z

Modified

2026-08-07T21:32:29.134414Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

OpenSIPS: Global Buffer Overflow in construct_uri

Details

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls constructuri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable503translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

Database specific

{
    "cwe_ids": [
        "CWE-120"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45537.json"
}

References

Affected packages

Git / github.com/opensips/opensips

Affected ranges

Type

GIT

Repo

https://github.com/opensips/opensips

Events

Introduced

f3e0d5333913bcaace4c8f8711871550accca63f

Introduced

985272ff3d7ebc5e9f24ad9f8fcf8b1d2549f1b6

Fixed

26c0c4e3364806e77c2915b1c3e03bf9bd90dccd

Fixed

b3621031661ed10d6af511d7c41f512075357a00

Fixed

4d23613b65579b073784a07a65d3bf52443a4efb

Fixed

5f103effaf5f372cccffe0b138f16998eba12668

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.6.6"
        },
        {
            "introduced": "4.0.0-beta"
        },
        {
            "fixed": "4.0.0-rc1"
        }
    ]
}

Affected versions

4.*

4.0.0-beta

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 1165.0,
            "function_hash": "226109660663622823631909999628572278192"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Function",
        "target": {
            "file": "msg_translator.c",
            "function": "construct_uri"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-0268cd07"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "85930018187884512745115767180453856631",
                "9123448050024963639918296936378324161",
                "92809748590602814031314121294972925619",
                "240765678873066602221693786686058347090",
                "182194714402083001125852811031434801325",
                "210330180258749208161186560082503475195",
                "274701893048541175074950407861772541431",
                "18787012699178113669500224280464431920",
                "205381219874839427522051611470170285208"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Line",
        "target": {
            "file": "parser/parse_body.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-05eaa95d"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "194553780228902367408282060407856839420",
                "183826118522500325336916991386153275102",
                "23609876740523779741945635475230307575",
                "141747783010088878646037041870850259125"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Line",
        "target": {
            "file": "net/proto_tcp/tcp_common.h"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-107957fa"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "85930018187884512745115767180453856631",
                "9123448050024963639918296936378324161",
                "92809748590602814031314121294972925619",
                "240765678873066602221693786686058347090",
                "182194714402083001125852811031434801325",
                "210330180258749208161186560082503475195",
                "274701893048541175074950407861772541431",
                "18787012699178113669500224280464431920",
                "205381219874839427522051611470170285208"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Line",
        "target": {
            "file": "parser/parse_body.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-122ca185"
    },
    {
        "digest": {
            "length": 571.0,
            "function_hash": "239673843364076259551748090071822079551"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Function",
        "target": {
            "file": "parser/parse_body.c",
            "function": "find_line_delimiter"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-129c1a0a"
    },
    {
        "digest": {
            "length": 571.0,
            "function_hash": "239673843364076259551748090071822079551"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Function",
        "target": {
            "file": "parser/parse_body.c",
            "function": "find_line_delimiter"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-22316bff"
    },
    {
        "digest": {
            "length": 1165.0,
            "function_hash": "226109660663622823631909999628572278192"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Function",
        "target": {
            "file": "msg_translator.c",
            "function": "construct_uri"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-30c936c5"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "259792131642235888277525552403952949501",
                "19727793969141095193342753458564901510",
                "250027361493129396404438022515615142387",
                "131530994763376973766044638250629325529"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Line",
        "target": {
            "file": "transformations.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-45d036bf"
    },
    {
        "digest": {
            "length": 5503.0,
            "function_hash": "69285013667388920103612027740108265861"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Function",
        "target": {
            "file": "net/proto_tcp/tcp_common.h",
            "function": "tcp_parse_headers"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-471fb556"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "194553780228902367408282060407856839420",
                "183826118522500325336916991386153275102",
                "23609876740523779741945635475230307575",
                "141747783010088878646037041870850259125"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Line",
        "target": {
            "file": "net/proto_tcp/tcp_common.h"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-595b96e9"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130220909244983205895730861006096440765",
                "201398176700919108372473887128474278781",
                "121445666154359984419269907102979981103",
                "108167142466647012142512874289336928524"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Line",
        "target": {
            "file": "modules/sipmsgops/sipmsgops.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-8e374df9"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "19310062195480744222226083625835443064",
                "339864232818495752804831665751736944949",
                "240018973462300301157123594980096397708",
                "269605422026381028125978291213120820099",
                "250504334230145485243675626025849081370",
                "118179321761923208172555936330597528500",
                "315624634716116334899958124016993442152"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Line",
        "target": {
            "file": "msg_translator.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-92f2e927"
    },
    {
        "digest": {
            "length": 1822.0,
            "function_hash": "192541007272035597802489654964185552143"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Function",
        "target": {
            "file": "modules/sipmsgops/sipmsgops.c",
            "function": "w_sip_to_json"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-a77a39d4"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130220909244983205895730861006096440765",
                "201398176700919108372473887128474278781",
                "121445666154359984419269907102979981103",
                "108167142466647012142512874289336928524"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Line",
        "target": {
            "file": "modules/sipmsgops/sipmsgops.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-c40209c2"
    },
    {
        "digest": {
            "length": 5503.0,
            "function_hash": "69285013667388920103612027740108265861"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Function",
        "target": {
            "file": "net/proto_tcp/tcp_common.h",
            "function": "tcp_parse_headers"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-cb92d957"
    },
    {
        "digest": {
            "length": 20896.0,
            "function_hash": "140898031237516326815696325741558996037"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Function",
        "target": {
            "file": "transformations.c",
            "function": "tr_eval_string"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-d98f0c26"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "19310062195480744222226083625835443064",
                "339864232818495752804831665751736944949",
                "240018973462300301157123594980096397708",
                "269605422026381028125978291213120820099",
                "250504334230145485243675626025849081370",
                "118179321761923208172555936330597528500",
                "315624634716116334899958124016993442152"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Line",
        "target": {
            "file": "msg_translator.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-da732c9a"
    },
    {
        "digest": {
            "length": 20896.0,
            "function_hash": "140898031237516326815696325741558996037"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Function",
        "target": {
            "file": "transformations.c",
            "function": "tr_eval_string"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-dcf18d16"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "259792131642235888277525552403952949501",
                "19727793969141095193342753458564901510",
                "250027361493129396404438022515615142387",
                "131530994763376973766044638250629325529"
            ]
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb",
        "signature_type": "Line",
        "target": {
            "file": "transformations.c"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-e5c152fb"
    },
    {
        "digest": {
            "length": 1822.0,
            "function_hash": "192541007272035597802489654964185552143"
        },
        "deprecated": false,
        "source": "https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668",
        "signature_type": "Function",
        "target": {
            "file": "modules/sipmsgops/sipmsgops.c",
            "function": "w_sip_to_json"
        },
        "signature_version": "v1",
        "id": "CVE-2026-45537-f2117fac"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45537.json"

vanir_signatures_modified

"2026-08-07T21:32:29Z"