{"id":"CVE-2026-77322","aliases":["GHSA-8h6x-h86x-75wh","GO-2026-6559"],"url":"https://o3.security/vulnerability/CVE-2026-77322","summary":"SIPGO: DoS via unvalidated WebSocket frame length","details":"### Summary\n\nThe WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS.\n\n### Details\n\n`WSConnection.Read` allocates a buffer from the declared WebSocket frame length before reading the payload (https://github.com/emiago/sipgo/blob/v1.4.0/sip/transport_ws.go#L400):\n\n```go\ndata := make([]byte, header.Length)   // header.Length is client-controlled, up to 2^63-1 (int64)\n```\n\n- `NextFrame()` reads only the frame header and never checks the length: `wsutil.NewReader` is created with no [`MaxFrameSize`](https://pkg.go.dev/github.com/gobwas/ws@v1.3.2/wsutil#Reader.MaxFrameSize) (`0` = unlimited). `ParseMaxMessageLength` applies only downstream, not here.\n- A value above the max slice size (e.g. `2^63-1`) panics `make`. sipgo does not recover from this panic, so it crashes the whole server process.\n\n### PoC\n\nTested on emiago/sipgo v1.4.0 (latest).\n\nAfter a normal WebSocket handshake, send one masked text frame consisting of the header only (no payload), declaring a huge length. The allocation runs as soon as the header is read.\n\n```\n0x81                                            FIN + text opcode\n0xFF                                            MASK bit + length marker 127 (8-byte length follows)\n0x7F FF FF FF FF FF FF FF                        declared length = 2^63-1  ->  make panics (crash)\n<4-byte masking key>\n(no payload)\n```\n\nThis crashes the server process:\n\n```\npanic: runtime error: makeslice: len out of range\n\ngoroutine 23 [running]:\ngithub.com/emiago/sipgo/sip.(*WSConnection).Read(...)\n        /path/to/pkg/mod/github.com/emiago/sipgo@v1.4.0/sip/transport_ws.go:400 +0x2df\ngithub.com/emiago/sipgo/sip.(*TransportWS).readConnection(...)\n        /path/to/pkg/mod/github.com/emiago/sipgo@v1.4.0/sip/transport_ws.go:194 +0x266\ncreated by github.com/emiago/sipgo/sip.(*TransportWS).initConnection in goroutine 21\n        /path/to/pkg/mod/github.com/emiago/sipgo@v1.4.0/sip/transport_ws.go:167 +0x268\n```\n\n### Suggested Fix\n\nSet [`MaxFrameSize`](https://pkg.go.dev/github.com/gobwas/ws@v1.3.2/wsutil#Reader.MaxFrameSize) on the `wsutil.NewReader`.\n\n### Impact\n\nUnauthenticated DoS. Any service using `sipgo` with a WS/WSS transport can be crashed by a single frame (panic), or forced to run out of memory.","published":"2026-09-22T19:52:12.441Z","modified":"2026-10-21T02:59:48.664400407Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/emiago/sipgo","fixedVersion":"1.4.3"}],"fix":{"url":"https://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc","label":"emiago/sipgo@769e4bc"},"references":[{"type":"WEB","url":"https://github.com/emiago/sipgo/releases/tag/v1.4.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77322.json"},{"type":"ADVISORY","url":"https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77322"},{"type":"FIX","url":"https://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc"},{"type":"PACKAGE","url":"https://github.com/emiago/sipgo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:48.664400407Z"}}