CVE-2026-90779

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

  • Published Sep 13, 2026
  • CVSS 8.7 high
  • 0.8% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-90779 at the National Vulnerability Database