CVE-2026-45103

CVE-2026-45103 is an unsigned integer overflow in OpenSIPS's TCP transport layer that allows SIP message smuggling. The overflow occurs when parsing Content-Length headers in TCP message framing — a calculation that happens before any authentication, routing script evaluation, or rate limiting executes. An attacker can wrap the Content-Length value to force the transport layer into miscalculating message boundaries, causing a second SIP message to be extracted from the same TCP stream but treated as a fresh, independently authenticated request. This is a parsing-before-security violation: the transport module treats message framing as trusted infrastructure, and the smuggled message inherits the authenticated context of the established TCP connection. This affects proto_tcp, proto_tls, proto_ws, and proto_wss — any OpenSIPS deployment with TCP enabled exposes a public attack surface requiring no authentication, no prior interaction, and no routing script logic to exploit. The compensating control of 'disable TCP' is not viable for most production deployments. Many OpenSIPS installations require TCP for NAT traversal, carrier gateway TLS interop, or WebSocket support for web-based clients. Disabling TCP breaks legitimate traffic. Network-layer segmentation can help but is partially undermined by the vulnerability itself — the attack works precisely because downstream systems trust the connection context that OpenSIPS propagates. Call recording, billing, and fraud detection systems all rely on the authenticated identity attached to the TCP stream, and this vulnerability lets attackers inject messages into that trust context. The patch in 3.6.6 and 4.0.0-rc1 adds overflow protection to the Content-Length arithmetic, which closes this specific exploit vector. However, the architectural inversion — where message boundary detection happens before security enforcement — likely remains unchanged. This means the blast radius of the vulnerability survives the fix. Future variants will likely exploit the same sequencing violation through different arithmetic mechanisms: signed/unsigned confusion, negative value injection, or integer narrowing. Organizations treating this as a one-time CVE closure rather than a structural architecture issue will find themselves vulnerable again within this same code path. Prioritize the upgrade to 3.6.6 or 4.0.0-rc1 immediately. For deployments that cannot patch within 72 hours, accept that no compensating control fully mitigates the risk — disabling TCP breaks production traffic, and alternative transports (WebSocket particularly) add their own parsing layers with similar ordering assumptions. Treat this as a high-priority upgrade cycle, not a managed risk.

Reviewed through automated stages and approved by a human before publication.