Description
A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resolve this issue. It is advisable to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | OpenSIPS | 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 4.0.0, 4.0.1 | 3.6.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | opensips | No fix yet | — |
References
- VDB-419834 | OpenSIPS rtpproxy rtpproxy_answer out-of-bounds vdb-entry technical-description
- VDB-419834 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-110679 | CVE Analysis and Report third-party-advisory
- Submit #1003897 | OpenSIPS >= 4.0.0, < 4.0.2 and >= 3.6.0, < 3.6.9 rtpproxy: Unauthenticated out-of-bounds read SIP Call-ID din dtm third-party-advisory
- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qv9x-v8jq-434w related
- https://github.com/OpenSIPS/opensips/releases/tag/4.0.2 patch
- https://github.com/OpenSIPS/opensips/ product