SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader

CVE-2026-90779 is a stack-based buffer overflow in SIPp's createAuthHeader() function, specifically in the getAuthParameter() helper that parses SIP authentication challenges (401/407 responses). When a SIP server returns an oversized or malformed algorithm parameter, the function copies it into a fixed 32-byte algo buffer without adequate bounds checking, corrupting the stack and crashing the SIPp client process. All versions through 3.7.7 are affected — and 3.7.7 is the latest release as of this writing. A fix exists in PR #880 but has not been cut into a release.

The vendor CVSS of 7.5 HIGH is technically defensible against the CVSS 3.1 rubric — it is network-reachable, no-auth, no-interaction, high-availability-impact. But this score catastrophically misrepresents real-world risk because it ignores what SIPp actually is: a SIP protocol *testing and benchmarking tool*, not production telephony infrastructure. SIPp is the thing you point at your PBX during a maintenance window to see if it can handle 10,000 concurrent calls. Crashing SIPp means your load test aborts. No production calls drop. No voicemail queues stall. No 911 service degrades. The CVSS score treats SIPp as though it were Oracleʼs SBC or a Cisco CUBE — it is not, and the vendor HIGH label is dramatically overblown for any enterprise patching queue.

1. Only run SIPp against org-controlled SIP infrastructure — SIPp should never be pointed at untrusted or Internet-facing SIP servers for testing. This is already standard practice in virtually all enterprises and eliminates the attack vector entirely. No SLA pressure — this is a LOW finding — but confirm this practice in your SIP testing runbooks as part of backlog hygiene.
2. Apply PR #880 patch from source if you build SIPp internally — If your organization builds SIPp from the GitHub master branch, cherry-pick the fix from PR #880. This bounds the getAuthParameter() copy to the buffer size. No mitigation SLA applies for LOW severity — treat as backlog hygiene.
3. Use ASAN or stack-canary-enabled builds for SIPp in CI — Compile SIPp with AddressSanitizer (-fsanitize=address) or ensure your distro package includes -fstack-protector-strong. This converts any stack overflow into a clean, detectable abort rather than undefined behavior. Useful regardless of this specific CVE.
4. Monitor for SIPp process crashes in automated test pipelines — If SIPp is invoked in CI/CD, ensure the pipeline treats a non-zero exit code as a test failure and alerts the team. This provides immediate visibility if the bug is ever triggered, whether by this CVE or any other crash.

Run this on any host where SIPp may be installed. Execute as any user with read access to the sipp binary. Example: bash check_cve_2026_90779.sh or bash check_cve_2026_90779.sh /usr/local/bin/sipp if the binary is in a non-standard location.

#!/usr/bin/env bash
# CVE-2026-90779 checker — SIPp createAuthHeader stack buffer overflow
# Checks installed SIPp version against affected range (<= 3.7.7)
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

SIPP_BIN="${1:-$(command -v sipp 2>/dev/null || true)}"

if [[ -z "$SIPP_BIN" ]]; then
  echo "UNKNOWN — sipp binary not found in PATH. Supply path as argument."
  exit 2
fi

if [[ ! -x "$SIPP_BIN" ]]; then
  echo "UNKNOWN — $SIPP_BIN is not executable."
  exit 2
fi

# SIPp prints version with -v flag; output format: "SIPp v3.7.7-..."
VERSION_OUTPUT=$($SIPP_BIN -v 2>&1 || true)
VERSION=$(echo "$VERSION_OUTPUT" | grep -oP 'v\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse version from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected SIPp version: $VERSION"

# Compare version — affected: <= 3.7.7
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

if (( MAJOR < 3 )) || \
   (( MAJOR == 3 && MINOR < 7 )) || \
   (( MAJOR == 3 && MINOR == 7 && PATCH <= 7 )); then
  echo "VULNERABLE — SIPp $VERSION is affected by CVE-2026-90779 (createAuthHeader stack buffer overflow)."
  echo "Note: No patched release exists yet. Apply PR #880 from https://github.com/SIPp/sipp/pull/880"
  exit 0
else
  echo "PATCHED — SIPp $VERSION is above the affected range (through 3.7.7)."
  exit 1
fi

1. OpenCVE — CVE-2026-90779 Detail
2. OSV — CVE-2026-90779
3. SIPp GitHub — auth.cpp source
4. SIPp GitHub — Releases (latest: v3.7.7)
5. OffSeq Threat Radar — CVE-2026-90779
6. Strix AI — CVE-2026-90779 Analysis
7. NixOS/nixpkgs — SIPp CVE Tracking Issue