{"id":4588,"date":"2026-09-04T18:46:37","date_gmt":"2026-09-04T10:46:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-45537"},"modified":"2026-09-04T18:46:37","modified_gmt":"2026-09-04T10:46:37","slug":"cve-2026-45537","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-45537","title":{"rendered":"CVE-2026-45537 [CRITICAL] &#8211; OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior t"},"content":{"rendered":"<p>OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server&#8217;s routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function&#8217;s data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4588","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}