6 matches found
CVE-2026-58268
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...
GHSA-PG59-5VWG-4JXQ SIPGO: DoS via unvalidated Content-Length in the stream parser
Summary The stream parser allocates the SIP body buffer from the Content-Length header before validating its size, which can lead to an unauthenticated DoS. Details ParserStream.parseSingle allocates the body buffer from the declared Content-Length with no size check...
CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...
CVE-2026-58268 SIPGO: DoS via unvalidated Content-Length in the stream parser
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...
PT-2026-97019
Name of the Vulnerable Software and Affected Versions SIPGO versions prior to 1.4.1 Description An unauthenticated peer can cause a denial of service by sending a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length. The ParserStream.parseSingle function in...
CVE-2026-58268: Memory Allocation with Excessive Size Value
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parserstream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transpor...