VYPR
Unrated severityNVD Advisory· Published Mar 15, 2023· Updated Feb 25, 2025

OpenSIPS has vulnerability in the Content-Length Parser

CVE-2023-28097

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the -m flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to 2362 or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than 2147483647.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • OpenSIPS/Opensipsllm-fuzzy2 versions
    < 3.1.9 or < 3.2.6+ 1 more
    • (no CPE)range: < 3.1.9 or < 3.2.6
    • (no CPE)range: < 3.1.9

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.