CVE-2023-28095

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

• CWE-20

• https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145cPatch, Third Party Advisory
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9hThird Party Advisory
• https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdfVendor Advisory
• https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145cPatch, Third Party Advisory
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9hThird Party Advisory
• https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdfVendor Advisory

Published

Mar 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2809Plaintext credential usage vulnerability in Sage 200 Spain 2…9.8
• CVE-2023-28090An HPE OneView appliance dump may expose SNMPv3 read credent…5.5
• CVE-2023-28091HPE OneView virtual appliance "Migrate server hardware" opti…5.5
• CVE-2023-28092A potential security vulnerability has been identified in HP…6.8
• CVE-2023-28093A user with a compromised configuration can start an unsigne…6.5
• CVE-2023-28094Pega platform clients who are using versions 7.4 through 8.8…9.8
• CVE-2023-28096OpenSIPS, a Session Initiation Protocol (SIP) server impleme…7.5
• CVE-2023-28097OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28098OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28099OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28100Flatpak is a system for building, distributing, and running …6.5
• CVE-2023-28101Flatpak is a system for building, distributing, and running …4.3