CVE-2026-58268: SIPGO: DoS via unvalidated Content-Length in the stream parser

September 22, 2026

The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS.

References

github.com/advisories/GHSA-pg59-5vwg-4jxq
github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c
github.com/emiago/sipgo/releases/tag/v1.4.1
github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq
nvd.nist.gov/vuln/detail/CVE-2026-58268

Code Behaviors & Features

Detect and mitigate CVE-2026-58268 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →