CVE Alert: CVE-2026-90779 – SIPp

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

High-risk network exposure: prioritise remediation for internet-facing or untrusted-SIP deployments, although KEV status, SSVC exploitation state, PoC availability and EPSS are not supplied, so active exploitation urgency cannot be confirmed.

An unauthenticated remote SIP peer can likely terminate the client process, disrupting call generation, testing, monitoring or service-validation workflows. Repeated crashes could create operational outages, conceal wider fraud or abuse, and consume analyst time during incident response. The stated impact is primarily availability rather than direct confidentiality or integrity loss.

### Most likely attack path

An attacker needs only network reachability to a client that processes SIP authentication challenges; no prior privileges, complex conditions or user interaction are indicated. They would induce an authentication response containing an oversized parameter, causing memory corruption and process failure. Scope is unchanged, so direct lateral movement is not implied, though interruption of a trusted communications or testing platform could support follow-on attacks.

### Who is most exposed

Prioritise publicly reachable clients, automated SIP test harnesses, continuous-integration runners, carrier interconnect probes and monitoring systems that communicate with untrusted endpoints. Privately isolated deployments with tightly allow-listed SIP peers are less exposed.

Alert on unexpected client restarts, core dumps or repeated segmentation faults.

Review SIP 401/407 responses for abnormal authentication algorithm lengths.

Correlate crashes with new or untrusted SIP source addresses.

Monitor service degradation, failed test runs and unusual authentication-challenge rates.

### Mitigation and prioritisation

Apply the vendor-recommended fixed release promptly; accelerate emergency change review for exposed systems.

Restrict SIP ingress and egress to approved peers; block unnecessary internet reachability.

Use protocol-aware filtering to reject malformed or oversized authentication parameters.

Run the client with least privilege, isolation and automatic restart limits.

EPSS, KEV and SSVC data are required to determine whether this warrants priority 1 treatment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.