CVE-2026-45809 Details
Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An attacker can create an oversized watcher entry by sending a SUBSCRIBE Event: presence request with a long From URI, and then trigger presence.winfo watcherinfo XML generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the process. A remote attacker can crash an OpenSIPS worker in deployments that expose handle_subscribe() and allow watcherinfo (presence.winfo) generation. The issue is configuration-dependent because the presence and presence_xml modules must be loaded and SUBSCRIBE routing must be reachable. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
A denial-of-service vulnerability has been identified in OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1. The issue arises in the watcherinfo generation process, where an attacker can send a SUBSCRIBE Event: presence request with a long From URI to create an oversized watcher entry. This triggers the presence.winfo watcherinfo XML generation for the same presentity, causing a stack buffer overflow that crashes the OpenSIPS process. The vulnerability is present in deployments that expose the handle_subscribe() function and allow watcherinfo generation, depending on the configuration of the presence and presence_xml modules.
Users are advised to upgrade to OpenSIPS versions 3.6.6, 4.0.0-rc1, or later fixed releases. If an immediate upgrade is not possible, access to the affected feature should be restricted or disabled until the patch can be applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |