UBUNTU-CVE-2026-45084
- Source
- https://ubuntu.com/security/CVE-2026-45084
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-45084.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-45084
- Upstream
- Published
- 2026-08-04T22:17:00Z
- Modified
- 2026-08-06T03:09:02.051030744Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handlepublish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enablespherecheck=1 is set, it invokes the getcontenttype() macro without first calling parsecontenttypehdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->contenttype->parsed is NULL and is dereferenced as a contentt pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.
- References
Affected packages
Ubuntu:18.04:LTS / opensips
Package
- Name
- opensips
- Purl
- pkg:deb/ubuntu/opensips?arch=source&distro=bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Ecosystem specific
{
"binaries": [
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-b2bua-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-berkeley-bin"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-berkeley-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-carrierroute-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-compression-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-console"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-cpl-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-dbhttp-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-dialplan-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-emergency-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-geoip-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-http-modules"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-identity-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-jabber-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-json-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-ldap-modules"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-lua-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-memcached-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-mysql-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-perl-modules"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-postgres-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-presence-modules"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-rabbitmq-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-radius-modules"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-redis-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-regex-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-restclient-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-sctp-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-snmpstats-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-sqlite-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-tls-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-tlsmgm-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-unixodbc-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-wss-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-xmlrpc-module"
},
{
"binary_version": "2.2.2-3build4",
"binary_name": "opensips-xmpp-module"
}
]
}