OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state (CVE-2026-45084) | HOL Guard CVE

High · CVSS 8.7CVE-2026-45084

OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state

Answer in brief

CVE-2026-45084 records a High severity (CVSS 8.7) vulnerability in OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state. The current sources do not mark it as known exploited. The current feed maps OpenSIPS/opensips (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 4, 2026Updated Sep 8, 2026Source checked Sep 18, 2026First seen by HOL Aug 4, 2026Material review Sep 8, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.7
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps OpenSIPS/opensips (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
OpenSIPS/opensipsgeneric	>= 3.4.0, < 3.6.6 \|\| >= 4.0.0-beta, < 4.0.0-rc1	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for OpenSIPS/opensips.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 4, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling parse_content_type_hdr(), causing it to dereference uninitialized or NULL Content-Type parsing state and crash. If a Content-Type header is present but unparsed, msg->content_type->parsed is NULL and is dereferenced as a content_t pointer; if the request lacks a Content-Type header entirely, msg->content_type itself is NULL, and both cases lead to a crash. A remote attacker can therefore cause a denial of service against an affected instance with a single PUBLISH request over UDP or TCP, using either a valid Content-Type: application/pidf+xml request or one with the header removed, and the vulnerable code path itself does not enforce authentication (though a deployment's routing configuration may require it before this route is reached). The issue has been fixed in version 3.6.6 and 4.0.0-rc1.

Quoted source text, attributed separately from HOL analysis.