CVE-2026-90780CWE-120

CVE-2026-90780

High · published September 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
58.0
In the wild
Unconfirmed
What it is

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00857 · 58.0th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-09-13T16:17Z
References (5)
https://github.com/SIPp/sipp · [email protected]https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L164-L227 · [email protected]https://github.com/SIPp/sipp/commit/8ddfb43359703e665041a955543e07f504f80232 · [email protected]https://github.com/SIPp/sipp/pull/881 · [email protected]https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-oversized-sip-header-content · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 1%
    epss
  • 13 SEP 11:42Z
    SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content
    cvelistv5