{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/sipgo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:emiago:sipgo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-77322"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sipgo (\u003c= 1.4.2)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","sipgo","go"],"_cs_type":"threat","_cs_vendors":["emiago"],"content_html":"\u003cp\u003eThe Go-based SIP library \u003ccode\u003esipgo\u003c/code\u003e (versions \u0026lt;= 1.4.2) contains a critical vulnerability in its WebSocket transport implementation, tracked as CVE-2026-77322. The \u003ccode\u003eWSConnection.Read\u003c/code\u003e function allocates a memory buffer based on the length field provided within a client-controlled WebSocket frame header without performing bounds validation.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eNextFrame()\u003c/code\u003e is called, it initializes a \u003ccode\u003ewsutil.NewReader\u003c/code\u003e without enforcing a \u003ccode\u003eMaxFrameSize\u003c/code\u003e limit. An attacker can initiate a standard WebSocket handshake and subsequently transmit a single masked text frame with a payload length declared as an extremely high value (e.g., 2^63-1). This triggers a runtime panic due to an attempt to allocate an out-of-range slice, leading to an immediate crash of the entire server process. This vulnerability is particularly dangerous as it is unauthenticated, trivial to exploit, and requires only a single network packet to disrupt service availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a WebSocket connection to the target server utilizing the \u003ccode\u003esipgo\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eAttacker performs the standard WebSocket handshake process to establish the transport session.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious masked WebSocket text frame.\u003c/li\u003e\n\u003cli\u003eAttacker sets the frame header length marker to \u003ccode\u003e127\u003c/code\u003e to indicate an 8-byte length field.\u003c/li\u003e\n\u003cli\u003eAttacker sets the length value in the frame header to \u003ccode\u003e0x7FFFFFFFFFFFFFFF\u003c/code\u003e (2^63-1).\u003c/li\u003e\n\u003cli\u003eServer process calls \u003ccode\u003eWSConnection.Read\u003c/code\u003e and proceeds to allocate a slice based on the malicious header length.\u003c/li\u003e\n\u003cli\u003eRuntime environment throws a \u003ccode\u003emakeslice: len out of range\u003c/code\u003e panic, resulting in an unhandled crash of the server process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate, unauthenticated denial of service by crashing the host application. Services utilizing \u003ccode\u003esipgo\u003c/code\u003e for SIP over WebSocket/WSS are susceptible to process termination, which can cause significant service disruption for telephony and communication infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003esipgo\u003c/code\u003e library to a version containing the fix for CVE-2026-77322, which enforces \u003ccode\u003eMaxFrameSize\u003c/code\u003e within \u003ccode\u003ewsutil.NewReader\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement upstream network filtering or WAF policies to drop WebSocket traffic containing header-declared payload lengths exceeding the maximum expected message size for your specific SIP application.\u003c/li\u003e\n\u003cli\u003eFor detection, monitor server logs for recurring application panics or process restarts shortly following a WebSocket handshake, which may indicate active exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T01:58:47Z","date_published":"2026-09-23T01:58:47Z","id":"https://feed.craftedsignal.io/briefs/2026-09-sipgo-dos/","summary":"An unauthenticated denial of service vulnerability in the sipgo WebSocket transport allows attackers to crash the service by sending a crafted frame with an oversized payload length field.","title":"Denial of Service via Unvalidated WebSocket Frame Length in sipgo","url":"https://feed.craftedsignal.io/briefs/2026-09-sipgo-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Sipgo","version":"https://jsonfeed.org/version/1.1"}