OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Conten…

OpenSIPS SIP server versions prior to 3.6.6 and 4.0.0-rc1 contain an integer overflow vulnerability in the TCP message framing layer. The Content-Length header is parsed using unsigned int arithmetic without overflow checks, allowing attackers to send crafted values (e.g., 4294967296) that wrap around to zero, causing incorrect TCP stream splitting. This enables SIP message smuggling over any TCP-based transport including proto_tcp, proto_tls, proto_ws, and proto_wss. Since the parsing occurs before authentication, unauthenticated remote attackers can exploit this with no preconditions. Successful exploitation allows bypassing SBC/proxy security policies, inheriting connection authentication context, and evading rate limiting. Patches are available in versions 3.6.6 and 4.0.0-rc1.