Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

CVE-2026-77322 — sipgo

HIGHFix: emiago/sipgo@769e4bc

CVE-2026-77322 is a high-severity (CVSS 7.5) CWE-789 vulnerability in github.com/emiago/sipgo. A fix is available for github.com/emiago/sipgo — see the affected versions and patch details below.

SIPGO: DoS via unvalidated WebSocket frame length

Also known asGHSA-8h6x-h86x-75whGO-2026-6559
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-77322.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs44th percentile — riskier than 44% of all scored CVEsHighest risk
0.02%0.36%0.69%1.02%0.5%0.5%Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-77322 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐹github.com/emiago/sipgo

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS.

Details

WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload (https://github.com/emiago/sipgo/blob/v1.4.0/sip/transport_ws.go#L400):

data := make([]byte, header.Length)   // header.Length is client-controlled, up to 2^63-1 (int64)
  • NextFrame() reads only the frame header and never checks the length: wsutil.NewReader is created with no MaxFrameSize (0 = unlimited). ParseMaxMessageLength applies only downstream, not here.
  • A value above the max slice size (e.g. 2^63-1) panics make. sipgo does not recover from this panic, so it crashes the whole server process.

PoC

Tested on emiago/sipgo v1.4.0 (latest).

After a normal WebSocket handshake, send one masked text frame consisting of the header only (no payload), declaring a huge length. The allocation runs as soon as the header is read.

0x81                                            FIN + text opcode
0xFF                                            MASK bit + length marker 127 (8-byte length follows)
0x7F FF FF FF FF FF FF FF                        declared length = 2^63-1  ->  make panics (crash)
<4-byte masking key>
(no payload)

This crashes the server process:

panic: runtime error: makeslice: len out of range

goroutine 23 [running]:
github.com/emiago/sipgo/sip.(*WSConnection).Read(...)
        /path/to/pkg/mod/github.com/emiago/[email protected]/sip/transport_ws.go:400 +0x2df
github.com/emiago/sipgo/sip.(*TransportWS).readConnection(...)
        /path/to/pkg/mod/github.com/emiago/[email protected]/sip/transport_ws.go:194 +0x266
created by github.com/emiago/sipgo/sip.(*TransportWS).initConnection in goroutine 21
        /path/to/pkg/mod/github.com/emiago/[email protected]/sip/transport_ws.go:167 +0x268

Suggested Fix

Set MaxFrameSize on the wsutil.NewReader.

Impact

Unauthenticated DoS. Any service using sipgo with a WS/WSS transport can be crashed by a single frame (panic), or forced to run out of memory.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/emiago/sipgoall versions1.4.3go get github.com/emiago/sipgo@v1.4.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/emiago/sipgo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/emiago/sipgo to 1.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-77322 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. ### Details `WSConnection.Read` allocates a buffer from the declared WebSocket frame length before reading the payload (https://github.com/emiago/sipgo/blob/v1.4.0/sip/transport_ws.go#L400): ```go data := make([]byte, header.Length) // header.Length is client-controlled, up to 2^63-1 (int64) ``` - `NextFrame()` reads only the frame header and never checks the length: `wsutil.NewReader` is created with no [`MaxFrameSize`](https://pkg.g
O3 Security · Impact-Aware SCA

Is CVE-2026-77322 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-77322: sipgo DoS — Fixed in 1.4.3