Description

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T12:17:17.093Z",
  "pubdate": "2026-09-13T12:17:17.093Z",
  "executiveSummary": "A critical buffer overflow vulnerability exists in SIPp versions through 3.7.7 within the header parsing logic.\nThe vulnerability is identified as a memory corruption issue stemming from improper input validation of SIP message headers.\nUnauthenticated remote attackers can exploit this flaw by transmitting a maliciously crafted SIP message containing a header that exceeds the hard-coded 20,490-byte limit of the internal buffer.\nSuccessful exploitation results in a process crash, leading to a Denial of Service (DoS) condition.\nGiven that SIPp is frequently used in performance and stress testing, this vulnerability poses significant availability risks if the software is exposed to untrusted network traffic during active testing or deployments.\nThe vulnerability does not require prior authentication or elevated privileges, making it accessible to any remote actor capable of reaching the SIPp service over the network.",
  "technicalDetails": "The vulnerability resides within the get_header() function located in src/sip_parser.cpp. The implementation utilizes a static buffer to store incoming SIP header content without performing adequate bounds checking prior to memory write operations.\nThe primary root cause is an insecure buffer management design where the allocated stack or global space is fixed at 20,490 bytes. When the parser encounters a SIP header exceeding this size, the input data overflows the allocated memory boundary, corrupting adjacent stack or memory segments.\nThe attack flow begins when an attacker sends a crafted SIP message to the SIPp instance. The parser, specifically the get_header() routine, begins processing the headers to extract metadata. As the function copies the oversized header content into the destination buffer, it lacks an explicit check against the maximum buffer capacity. The excess data overwrites critical control information, such as return addresses or other local variables, leading to an immediate segmentation fault and termination of the SIPp process.\nSince SIPp is typically designed to handle high volumes of traffic, an attacker can intentionally weaponize this flaw to disrupt automated testing environments or telecommunication infrastructure monitoring systems. The attack requires no authentication, and the network exposure is inherent to the listener port configured for SIP traffic (typically UDP/TCP 5060).\nBeyond simple process termination, the memory corruption potentially facilitates arbitrary code execution if an attacker can precisely control the overflow data to overwrite the instruction pointer (EIP/RIP). However, the primary observable impact remains a high-reliability Denial of Service that disrupts the operational availability of the testing suite. The vulnerable component is the core parser module, which processes untrusted inputs directly from the network interface.\nThe vulnerability affects all versions of SIPp up to and including 3.7.7. The absence of input sanitization or dynamic memory allocation (e.g., using safe string handling or dynamic vectors) ensures that the parser remains susceptible to any malformed SIP message that violates the defined length constraints."
}