CVE-2023-28097

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-28097
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28097.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-28097
Aliases
  • GHSA-c6j5-f4h4-2xrq
Downstream
Published
2023-03-15T22:03:41.362Z
Modified
2025-11-29T14:09:39.788491Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenSIPS has vulnerability in the Content-Length Parser
Details

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large Content-Length value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the -m flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to 2362 or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than 2147483647.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28097.json",
    "cwe_ids": [
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/opensips/opensips

Affected ranges

Type
GIT
Repo
https://github.com/opensips/opensips
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
949719bf4baeb5da9787b9c4191e061fe800d9eb
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.1.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/opensips/opensips
Events
Introduced
1e94abe8837fe3511fada132d67a6385d8d099a2
Fixed
ce8cda891ce6cc48ff7dc2e75f683e4e45798c6c
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.6"
        }
    ]
}

Affected versions

1.*

1.11.0

2.*

2.1-alpha1
2.1-alpha2
2.1-alpha3
2.1-rc1

3.*

3.1.0
3.1.0-beta
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5