Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing the required colon delimiter can corrupt parsed SDP bandwidth metadata. When a route or module subsequently clones the corrupted SDP state, as occurs with dialog and QoS processing, the OpenSIPS worker process crashes. An unauthenticated remote attacker can therefore trigger a crash in any configuration whose routing script parses attacker-controlled SDP and applies dialog/QoS processing. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
OpenSIPS deployments face high-severity DoS risk (CVE-2026-46334) in SDP parsing. Update to 3.6.6+ or 4.0.0-rc1 if using older releases. Review VoIP infrastructure now. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/YsHBoYVmWC
Post summary
The post alerts users of a high‑severity DoS vulnerability in OpenSIPS SDP parsing (CVE‑2026‑46334) and recommends upgrading to version 3.6.6 or newer.