{"id":"CVE-2026-45537","summary":"OpenSIPS: Global Buffer Overflow in construct_uri","details":"OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.","aliases":["GHSA-v7h4-fwrc-c66v"],"modified":"2026-08-07T21:32:29.134414Z","published":"2026-08-04T22:48:43.580Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45537.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45537.json"},{"type":"ADVISORY","url":"https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45537"},{"type":"FIX","url":"https://github.com/OpenSIPS/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"},{"type":"FIX","url":"https://github.com/OpenSIPS/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opensips/opensips","events":[{"introduced":"f3e0d5333913bcaace4c8f8711871550accca63f"},{"introduced":"985272ff3d7ebc5e9f24ad9f8fcf8b1d2549f1b6"},{"fixed":"26c0c4e3364806e77c2915b1c3e03bf9bd90dccd"},{"fixed":"b3621031661ed10d6af511d7c41f512075357a00"},{"fixed":"4d23613b65579b073784a07a65d3bf52443a4efb"},{"fixed":"5f103effaf5f372cccffe0b138f16998eba12668"}],"database_specific":{"extracted_events":[{"introduced":"3.4.0"},{"fixed":"3.6.6"},{"introduced":"4.0.0-beta"},{"fixed":"4.0.0-rc1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["4.0.0-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45537.json","vanir_signatures_modified":"2026-08-07T21:32:29Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"226109660663622823631909999628572278192","length":1165},"id":"CVE-2026-45537-0268cd07","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"msg_translator.c","function":"construct_uri"}},{"deprecated":false,"digest":{"line_hashes":["85930018187884512745115767180453856631","9123448050024963639918296936378324161","92809748590602814031314121294972925619","240765678873066602221693786686058347090","182194714402083001125852811031434801325","210330180258749208161186560082503475195","274701893048541175074950407861772541431","18787012699178113669500224280464431920","205381219874839427522051611470170285208"],"threshold":0.9},"id":"CVE-2026-45537-05eaa95d","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"parser/parse_body.c"}},{"digest":{"line_hashes":["194553780228902367408282060407856839420","183826118522500325336916991386153275102","23609876740523779741945635475230307575","141747783010088878646037041870850259125"],"threshold":0.9},"id":"CVE-2026-45537-107957fa","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"net/proto_tcp/tcp_common.h"},"deprecated":false},{"target":{"file":"parser/parse_body.c"},"deprecated":false,"digest":{"line_hashes":["85930018187884512745115767180453856631","9123448050024963639918296936378324161","92809748590602814031314121294972925619","240765678873066602221693786686058347090","182194714402083001125852811031434801325","210330180258749208161186560082503475195","274701893048541175074950407861772541431","18787012699178113669500224280464431920","205381219874839427522051611470170285208"],"threshold":0.9},"id":"CVE-2026-45537-122ca185","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"},{"digest":{"function_hash":"239673843364076259551748090071822079551","length":571},"id":"CVE-2026-45537-129c1a0a","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"parser/parse_body.c","function":"find_line_delimiter"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"parser/parse_body.c","function":"find_line_delimiter"},"deprecated":false,"digest":{"function_hash":"239673843364076259551748090071822079551","length":571},"id":"CVE-2026-45537-22316bff","signature_type":"Function"},{"digest":{"length":1165,"function_hash":"226109660663622823631909999628572278192"},"id":"CVE-2026-45537-30c936c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"msg_translator.c","function":"construct_uri"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["259792131642235888277525552403952949501","19727793969141095193342753458564901510","250027361493129396404438022515615142387","131530994763376973766044638250629325529"],"threshold":0.9},"id":"CVE-2026-45537-45d036bf","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"transformations.c"}},{"deprecated":false,"digest":{"length":5503,"function_hash":"69285013667388920103612027740108265861"},"id":"CVE-2026-45537-471fb556","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"net/proto_tcp/tcp_common.h","function":"tcp_parse_headers"}},{"target":{"file":"net/proto_tcp/tcp_common.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["194553780228902367408282060407856839420","183826118522500325336916991386153275102","23609876740523779741945635475230307575","141747783010088878646037041870850259125"]},"id":"CVE-2026-45537-595b96e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668"},{"signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"modules/sipmsgops/sipmsgops.c"},"deprecated":false,"digest":{"line_hashes":["130220909244983205895730861006096440765","201398176700919108372473887128474278781","121445666154359984419269907102979981103","108167142466647012142512874289336928524"],"threshold":0.9},"id":"CVE-2026-45537-8e374df9","signature_type":"Line"},{"target":{"file":"msg_translator.c"},"deprecated":false,"digest":{"line_hashes":["19310062195480744222226083625835443064","339864232818495752804831665751736944949","240018973462300301157123594980096397708","269605422026381028125978291213120820099","250504334230145485243675626025849081370","118179321761923208172555936330597528500","315624634716116334899958124016993442152"],"threshold":0.9},"id":"CVE-2026-45537-92f2e927","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb"},{"signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"modules/sipmsgops/sipmsgops.c","function":"w_sip_to_json"},"deprecated":false,"digest":{"function_hash":"192541007272035597802489654964185552143","length":1822},"id":"CVE-2026-45537-a77a39d4","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["130220909244983205895730861006096440765","201398176700919108372473887128474278781","121445666154359984419269907102979981103","108167142466647012142512874289336928524"],"threshold":0.9},"id":"CVE-2026-45537-c40209c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"modules/sipmsgops/sipmsgops.c"}},{"deprecated":false,"digest":{"function_hash":"69285013667388920103612027740108265861","length":5503},"id":"CVE-2026-45537-cb92d957","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"net/proto_tcp/tcp_common.h","function":"tcp_parse_headers"}},{"source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"transformations.c","function":"tr_eval_string"},"deprecated":false,"digest":{"function_hash":"140898031237516326815696325741558996037","length":20896},"id":"CVE-2026-45537-d98f0c26","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["19310062195480744222226083625835443064","339864232818495752804831665751736944949","240018973462300301157123594980096397708","269605422026381028125978291213120820099","250504334230145485243675626025849081370","118179321761923208172555936330597528500","315624634716116334899958124016993442152"]},"id":"CVE-2026-45537-da732c9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"msg_translator.c"}},{"deprecated":false,"digest":{"function_hash":"140898031237516326815696325741558996037","length":20896},"id":"CVE-2026-45537-dcf18d16","signature_type":"Function","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"transformations.c","function":"tr_eval_string"}},{"deprecated":false,"digest":{"line_hashes":["259792131642235888277525552403952949501","19727793969141095193342753458564901510","250027361493129396404438022515615142387","131530994763376973766044638250629325529"],"threshold":0.9},"id":"CVE-2026-45537-e5c152fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/opensips/opensips/commit/4d23613b65579b073784a07a65d3bf52443a4efb","target":{"file":"transformations.c"}},{"source":"https://github.com/opensips/opensips/commit/5f103effaf5f372cccffe0b138f16998eba12668","target":{"file":"modules/sipmsgops/sipmsgops.c","function":"w_sip_to_json"},"deprecated":false,"digest":{"length":1822,"function_hash":"192541007272035597802489654964185552143"},"id":"CVE-2026-45537-f2117fac","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}