CVE-2026-90778: SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
SIPp through 3.7.7 contains a buffer overflow vulnerability in getpeertag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SIPp installations through version 3.7.7 are exposed if they process SIP messages from a remote source. The vulnerable code is reached while processing the tag parameter in a SIP To header.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need network access to send a crafted SIP message containing a To-header tag parameter of 2049 bytes or more.
What is the expected impact of exploitation?
The described impact is a process crash caused by overflowing a static buffer, resulting in a denial of service. No confidentiality or integrity impact is stated.
How can I identify exploit attempts or exposure in message traffic?
Inspect SIP messages received by SIPp for To headers with tag parameters that are 2049 bytes or longer. Systems running SIPp through 3.7.7 that accept such traffic should be treated as affected.