CVE-2026-45705 Details
Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
A vulnerability allowing an out-of-bounds read has been identified in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. The issue arises in the `find_line_delimiter()` function of the multipart body parser, which improperly reads beyond the allocated buffer when searching for MIME boundary delimiters. This out-of-bounds read occurs after the function detects a `--` pattern near the end of the body, and compares a specified length of bytes from a position that can extend past the logical end of the body buffer. The vulnerability is triggered by SIP messages with a `Content-Type` of `multipart/mixed`, where the body contains a `--` near the end without being followed by the actual boundary delimiter.
Users can upgrade to OpenSIPS versions 3.6.6 or 4.0.0-rc1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |