CyberRota Analysis
AI-GeneratedThe SIPGO library prior to version 1.4.1 is vulnerable to a denial-of-service attack due to improper handling of the Content-Length header, allowing unauthenticated clients to send oversized messages that lead to excessive memory allocation. This vulnerability can result in service disruption for applications utilizing SIPGO for SIP services. Organizations using affected versions should prioritize upgrading to 1.4.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.