CVE-2026-58268: SIPGO: DoS via unvalidated Content-Length in the stream parser

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-22 · updated 2026-09-23
Weakness: CWE-789

Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

Affected products

emiago sipgo: before 1.4.1

References

https://github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c
https://github.com/emiago/sipgo/releases/tag/v1.4.1
https://github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq

Get alerted when CVE-2026-58268 or the next vulnerability affects your stack