Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-58268, describes an unauthenticated Denial of Service (DoS) in the sipgo library. The core issue is that the stream parser allocates a buffer for the SIP body based on the Content-Length header without first validating if this size exceeds a reasonable limit. This allows an attacker to specify an arbitrarily large Content-Length, forcing the server to attempt a massive memory allocation and crash.
The provided commit a7be60a07f48c06b3cdd5a7d35eb820b3df5736c directly addresses this vulnerability. The patch modifies the parseSingle function within sip/parser_stream.go. Specifically, it adds a check if (p.totalRead + contentLength) > p.p.MaxMessageLength immediately before the body := make([]byte, contentLength) call. This confirms that in the vulnerable version (prior to this patch), the make([]byte, contentLength) operation was performed without this crucial size validation.
Therefore, ParserStream.parseSingle is the vulnerable function as it directly performs the unbounded memory allocation based on unvalidated user input. Exploitation would involve sending a crafted SIP message, and this function would be directly involved in processing the malicious Content-Length header and attempting the excessive memory allocation.
ParserStream.parseSinglesip/parser_stream.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/emiago/sipgo | go | <= 1.4.0 | 1.4.1 |