CyberRota Analysis
AI-GeneratedThe WSConnection.Read function in the SIPGO library prior to version 1.4.3 is vulnerable to a denial-of-service attack due to improper handling of client-controlled frame headers, which can lead to oversized memory allocations and potential crashes. Unauthenticated attackers can exploit this vulnerability to exhaust server memory, impacting service availability. Organizations using SIPGO for SIP services should prioritize upgrading to version 1.4.3 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.