CVE-2026-45103

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

• CWE-190

• https://github.com/OpenSIPS/opensips/commit/4d23613b
• https://github.com/OpenSIPS/opensips/commit/5f103eff
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh

Published

Aug 4, 2026

Last Modified

Aug 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4509A security flaw has been discovered in PbootCMS up to 3.2.12…6.3
• CVE-2026-45090Dalfox is a powerful open-source XSS scanner and utility foc…7.5
• CVE-2026-45091sealed-env is a cross-stack, zero-trust secret management li…9.1
• CVE-2026-4510A weakness has been identified in PbootCMS up to 3.2.12. Thi…4.3
• CVE-2026-45100OpenSIPS is a Session Initiation Protocol (SIP) server imple…9.1
• CVE-2026-45102OneUptime is an open-source monitoring and observability pla…9.9
• CVE-2026-45104MapServer is a system for developing web-based GIS applicati…7.5
• CVE-2026-45106Weblate is a web based localization tool. Prior to version 2…4.6
• CVE-2026-45108Himmelblau is an interoperability suite for Microsoft Azure …8.4
• CVE-2026-45109Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-4511A security vulnerability has been detected in vanna-ai vanna…6.3
• CVE-2026-45112Allocation of Resources Without Limits or Throttling vulnera…7.5