CVE-2026-90780

SIPp through version 3.7.7 contains a classic buffer overflow (CWE-120) in the get_header() function in src/sip_parser.cpp, which copies SIP header content into a fixed-size static buffer of roughly 20,490 bytes without adequate bounds checking. A remote, unauthenticated attacker can trigger the flaw simply by sending a crafted SIP message containing an oversized header to a running SIPp instance, overflowing the buffer and crashing the process. The impact is a denial of service against SIPp itself — integrity and confidentiality are not affected per the CVSS 4.0 vector (VA:H only), which nevertheless rates the issue high at 8.7 due to the trivial network attack path with no privileges or user interaction required. Anyone running SIPp 3.7.7 or earlier as a listener (e.g., in server/uas mode over UDP or TCP) on a reachable network is affected. No public proof of concept is known and the CVE is not on the CISA KEV list, so exploitation is not known to have occurred.

What to do: Upgrade SIPp to the latest release, since all versions through 3.7.7 are vulnerable, and check whether any long-running or scripted SIPp listeners (uas/server mode on UDP/TCP 5060/5061) are deployed. Until a patched version is confirmed, restrict SIPp's listening ports with host firewalls or network ACLs so only trusted test clients can reach it, and prefer running it in isolated lab or containerized environments rather than on internet-reachable hosts. Monitor SIPp processes for unexpected crashes, which would be the primary indicator of malformed oversized-header traffic.