CVE-2026-90779

SIPp, the open-source SIP traffic and load-testing tool, contains a stack buffer overflow (CWE-121) in its createAuthHeader() function in all versions through 3.7.7. The flaw is triggered when SIPp attempts SIP authentication against a server that replies with a crafted 401 Unauthorized or 407 Proxy Authentication Required challenge carrying an oversized algorithm parameter, which overflows a stack buffer. A malicious or compromised SIP server can use this to corrupt the stack and crash the client process, so the practical impact scored by CVSS 4.0 (8.7) is denial of service of the testing client, though stack corruption vulnerabilities can in principle be more severe. Anyone running SIPp up to 3.7.7 in authenticated scenarios against untrusted or partially trusted SIP endpoints is affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no evidence of in-the-wild exploitation.

What to do: Upgrade SIPp to a release newer than 3.7.7 as soon as the maintainers publish a fix, and check the upstream repository for a patched build. Until then, only run authenticated SIPp scenarios against trusted, controlled test servers and avoid pointing it at third-party or unknown SIP endpoints. Running SIPp in a sandboxed or containerized environment limits the blast radius of a crash or potential code execution.