CVE-2026-58268CWE-789

CVE-2026-58268

High · published September 23, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00609 · 48.5th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-09-23T00:17Z
References (3)
https://github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c · [email protected]https://github.com/emiago/sipgo/releases/tag/v1.4.1 · [email protected]https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq · [email protected]
EPSS history
Timeline
  • 24 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 22 SEP 19:49Z
    SIPGO: DoS via unvalidated Content-Length in the stream parser
    cvelistv5