CVE-2026-77322

7.5 Élevée

Publiée le 22/09/2026 à 22:17 · Modifiée le 23/09/2026 à 20:12 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.

Traduire en français

Produits concernés

emiago sipgo

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-789

Références

https://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc
https://github.com/emiago/sipgo/releases/tag/v1.4.3
https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh
https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories