High severity · published Sep 13, 2026
CVE-2026-90780
SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
sipp · SIPp
through 3.7.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90780
github.com
https://github.com/SIPp/sipp
github.com
https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L164-L227
github.com
https://github.com/SIPp/sipp/commit/8ddfb43359703e665041a955543e07f504f80232
github.com
https://github.com/SIPp/sipp/pull/881
www.vulncheck.com
https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-oversized-sip-header-content
More from sipp
8.4
CVE-2018-25356
SIPp 3.6 Local Buffer Overflow via Command-line Arguments
7.8
CVE-2018-25225
SIPP 3.3 Stack-Based Buffer Overflow via Configuration File
7.5
CVE-2026-90779
SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
7.5
CVE-2026-90778
SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
–
CVE-2008-1959
Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary…