CVE-2026-58268

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58268
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58268.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58268
Aliases
Downstream
CGA (1)
MINI (2)
Published
2026-09-22T19:49:09Z
Modified
2026-09-23T11:45:14Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
SIPGO: DoS via unvalidated Content-Length in the stream parser
Details

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58268.json"
}
References

Affected packages

Git / github.com/emiago/sipgo

Affected ranges

Type
GIT
Repo
https://github.com/emiago/sipgo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7be60a07f48c06b3cdd5a7d35eb820b3df5736c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.4.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.22.1
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.25.1
v0.26.0
v0.26.1
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.31.0
v0.32.0
v0.32.1
v0.33.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.9.0
v1.*
v1.0.0
v1.0.0-alpha
v1.0.0-alpha-1
v1.0.0-alpha-2
v1.0.0-beta-1
v1.0.0-beta-2
v1.0.0-beta-3
v1.0.0-beta-4
v1.0.1
v1.0.1-alpha
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58268.json"