SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header

CVE-2026-90780 is a classic buffer overflow (CWE-120) in SIPp's get_header() function inside src/sip_parser.cpp. When the tool parses a SIP message whose header content exceeds 20,490 bytes, it overflows a static buffer and the process crashes. All SIPp versions from 3.4-beta1 through 3.7.7 are affected. The fix exists in upstream commits (8ddfb43 and 369b3c1) and PR #881, but no official v3.7.8 release has been cut yet — the latest tagged release remains v3.7.7.

The vendor CVSS 3.1 score of 7.5 HIGH is mechanically correct: network-reachable, no auth, low complexity, full availability impact. But it wildly overstates the real-world risk because it ignores *what SIPp actually is*. SIPp is a SIP protocol testing and load-generation tool — it is not an SBC, PBX, proxy, or any production VoIP component. It is run on demand by QA engineers in lab/staging networks to stress-test SIP infrastructure, then stopped. Crashing a SIPp process means a load test aborts. No production calls drop, no service degrades, no data leaks. The CVSS model has no field for 'nobody runs this in prod,' so the mechanical score lands at HIGH when reality is firmly LOW.

1. Isolate SIPp to dedicated test VLANs — SIPp should never listen on a routable production network segment. Ensure test/lab networks are firewalled from production and from the internet. This is standard practice and eliminates remote attack surface entirely. No mitigation SLA applies for a LOW verdict — treat as backlog hygiene.
2. Build from patched source when convenient — Cherry-pick commits 8ddfb43 or 369b3c1 (or pull from HEAD after PR #881 merged) and rebuild. If you use NixOS, the backport PR #563981 carries the fix. Under the noisgate remediation SLA for LOW, this is backlog work — no hard deadline, but next time you rebuild your test toolchain is a fine time.
3. Cap SIP message size at the SBC or test proxy — If your test topology routes traffic through an SBC or SIP proxy before it hits SIPp, configure a max-message-size policy (20 KB is a safe ceiling for any legitimate SIP message per RFC 3261 §18.1.1). This prevents the oversized header from ever reaching SIPp.

Run this script on any host where SIPp is installed (the test/lab machine, not a production server). Execute as a normal user: bash check_sipp_cve_2026_90780.sh. No elevated privileges required — it only checks the installed version.

#!/usr/bin/env bash
# check_sipp_cve_2026_90780.sh
# Checks whether the installed SIPp version is vulnerable to CVE-2026-90780
# (buffer overflow in get_header() for headers > 20,490 bytes).
# Affected: all versions <= 3.7.7
# Fixed: commits 8ddfb43 / 369b3c1 (no official release yet as of 2026-09-20)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

VULN_MAJOR=3
VULN_MINOR=7
VULN_PATCH=7

if ! command -v sipp &>/dev/null; then
  echo "UNKNOWN — sipp binary not found in PATH."
  exit 2
fi

# sipp -v prints version to stderr in most builds
RAW_VERSION=$(sipp -v 2>&1 || true)

# Try to extract version like "SIPp v3.7.7" or "SIPp 3.7.7"
VERSION=$(echo "$RAW_VERSION" | grep -oP '(?i)sipp\s+v?\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse SIPp version from output."
  echo "Raw output: $RAW_VERSION"
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

echo "Detected SIPp version: $VERSION"

# Compare: vulnerable if version <= 3.7.7
if (( MAJOR < VULN_MAJOR )); then
  echo "VULNERABLE — SIPp $VERSION is affected by CVE-2026-90780."
  exit 1
elif (( MAJOR == VULN_MAJOR && MINOR < VULN_MINOR )); then
  echo "VULNERABLE — SIPp $VERSION is affected by CVE-2026-90780."
  exit 1
elif (( MAJOR == VULN_MAJOR && MINOR == VULN_MINOR && PATCH <= VULN_PATCH )); then
  echo "VULNERABLE — SIPp $VERSION is affected by CVE-2026-90780."
  exit 1
else
  echo "PATCHED — SIPp $VERSION is newer than 3.7.7."
  exit 0
fi

1. NVD — CVE-2026-90780
2. OpenCVE — CVE-2026-90780
3. OSV — CVE-2026-90780
4. SIPp GitHub Repository
5. Vulnerable Code (sip_parser.cpp L164–227)
6. Fix Commit 8ddfb43
7. NixOS Backport PR #563981
8. VulnCheck Advisory