CVE-2026-77322highCWE-789

CVE-2026-77322: falha de alta gravidade em emiago sipgo

SIPGO: DoS via unvalidated WebSocket frame length

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar sipgo+ Monitorar github.com/emiago/sipgo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
emiago · sipgo
CVEs relacionadas — emiago sipgo

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58268HIGHSIPGO: DoS via unvalidated Content-Length in the stream parserEPSS 0.6%CVE-2025-68274HIGHSIPGO library has response DoS vulnerability via nil pointer dereferenceEPSS 0.5%