SIPGO library has response DoS vulnerability via nil pointer dereference

Vulnerability

Overview

A nil pointer dereference vulnerability exists in the SIPGO library (versions ≥0.3.0 and <1.0.0-alpha-1) within the NewResponseFromRequest function. The root cause is an unchecked assumption that the To header is always present in the parsed SIP request, leading to a panic when res.To().Params is accessed on a nil receiver [2][3]. The flaw was introduced when the library's response creation logic copied headers from the request but failed to verify the existence of the To header before attempting to manipulate its parameters add a tag parameter.

Exploitation

An attacker can trigger the vulnerability by sending a single malformed SIP request that lacks a To header. No authentication or special network access is required; the attack is remote and can be performed over any SIP message processed by the library. The parsing step tolerates the missing header, but the subsequent response creation in NewResponseFromRequest dereferences a nil pointer, causing a segmentation fault (SIGSEGV) [1][3].

Impact

Successful exploitation results in an immediate crash (denial of service) of any SIP application that uses the vulnerable function, including call setup, registration, and authentication flows. The advisory notes that this affects all normal SIP operations, not just error handling paths [2][3].

Mitigation

The issue is patched in version 1.0.0-alpha-1 by adding a nil check for the To header field before accessing its parameters [4]. Users of the library should upgrade immediately as there is no workaround; unpatched versions expose their SIP services to remote DoS attacks [2][3].