CVE-2026-58268: SIPGO: DoS via unvalidated Content-Length in the stream parser

September 22, 2026

The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS.

References

github.com/advisories/GHSA-pg59-5vwg-4jxq
github.com/emiago/sipgo/commit/a7be60a07f48c06b3cdd5a7d35eb820b3df5736c
github.com/emiago/sipgo/releases/tag/v1.4.1
github.com/emiago/sipgo/security/advisories/GHSA-pg59-5vwg-4jxq
nvd.nist.gov/vuln/detail/CVE-2026-58268

Code Behaviors & Features

Detect and mitigate CVE-2026-58268 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →