HIGH

CVE-2026-90778

2026-09-13 CVSS v3.1

CVSS

7.5

Description

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

Weakness (CWE)

CWE-120 Classic Buffer Overflow

EPSS Score

0.63%

Probability of exploitation in next 30 days

48.9th percentile

References

https://github.com/SIPp/sipp https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L76-L113 https://github.com/SIPp/sipp/commit/ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4 https://github.com/SIPp/sipp/pull/879 https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-sip-to-header-tag

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE