CVE-2026-90778

SIPp, an open-source SIP traffic generation and testing tool, contains a classic buffer overflow (CWE-120) in its get_peer_tag() function affecting all versions through 3.7.7. The flaw is triggered when SIPp processes a SIP To header whose tag parameter is 2049 bytes or longer, overflowing a static buffer. An unauthenticated remote attacker can exploit this by sending a crafted SIP message to a running SIPp instance, crashing the process; while the CVSS 4.0 score of 8.7 (high) reflects availability-only impact (VA:H, no confidentiality or integrity impact), memory corruption from a stack/static buffer overflow could in principle be worse depending on build and platform. Anyone running SIPp 3.7.7 or earlier against untrusted networks or SIP peers is affected. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Upgrade SIPp to a release newer than 3.7.7 as soon as a fixed build is available from the upstream project, or build from patched source. Until then, run SIPp only in isolated lab or CI networks and use firewall rules/ACLs to restrict SIP traffic to trusted peers so unauthenticated third parties cannot reach the listening socket. Check for unexplained SIPp process crashes and unusually large tag parameters in SIP To headers as indicators of crafted malicious traffic.