Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck

CVE-2026-90780SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content

High 7.5

In plain English

A high-severity buffer overflow in sipp from SIPp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

Affected products (as reported)

Vendor	Product	Versions
SIPp	sipp	0 – through 3.7.7

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Pull Request #881 patch, issue-tracking
Patch Commit patch
Unbounded sprintf concatenation in get_header() at v3.7.7 technical-description
https://github.com/SIPp/sipp product
VulnCheck Advisory: SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content third-party-advisory