Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck

CVE-2026-90778SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

High 7.5

In plain English

A high-severity buffer overflow in sipp from SIPp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

Affected products (as reported)

Vendor	Product	Versions
SIPp	sipp	0 – through 3.7.7

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Pull Request #879 patch, issue-tracking
Patch Commit patch
Unbounded copy in get_peer_tag() at v3.7.7 technical-description
https://github.com/SIPp/sipp product
VulnCheck Advisory: SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag third-party-advisory