CVE-2026-58268

HighCVSS 7.5/10Last modified Sep 23, 2026

Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-582698.1Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/tok CVE-2026-58277.3A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /question-functi CVE-2026-582706.5Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpo CVE-2026-582716.8Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync CVE-2026-582725.3Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observab CVE-2026-582759.8Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-582767.5Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-582778.8Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-582785.4Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-582796.5Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-58287.3A vulnerability was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /function CVE-2026-582807.5Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.