CVE-2023-28096— OpenSIPS has memory leak in cJSON lib
Quick assessment
Affected
OpenSIPS opensips
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenSIPS是OpenSIPS 个人开发者的一个 GPL 许可的 SIP 服务器实现。 OpenSIPS 2.3版本至3.2版本存在安全漏洞，该漏洞源于通过函数parse_mi_request检测到存在内存泄漏问题。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28096
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenSIPS has memory leak in cJSON lib
Source: CVE Program / CVE List V5
Vulnerability Description
OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.
To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.
The issue has been fixed in versions 3.1.8 and 3.2.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSIPS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSIPS是OpenSIPS 个人开发者的一个 GPL 许可的 SIP 服务器实现。 OpenSIPS 2.3版本至3.2版本存在安全漏洞，该漏洞源于通过函数parse_mi_request检测到存在内存泄漏问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-28096
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28096
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-28096 (1)
Vendor Advisories for CVE-2023-28096 (1)
-
https://github.com/OpenSIPS/opensips/security/advisories/GHSA-2mg2-g46r-j4qr x_refsource_CONFIRM
Other References for CVE-2023-28096 (1)
Same Patch Batch · OpenSIPS · 2023-03-15 · 11 CVEs total
| CVE-2023-27596 | 7.5 HIGH | OpenSIPS has vulnerability in the codec_delete_XX() functions |
| CVE-2023-27597 | 7.5 HIGH | OpenSIPS has vulnerability in the parse_uri() function |
| CVE-2023-27598 | 7.5 HIGH | OpenSIPS has vulnerability in the parse_via() function |
| CVE-2023-27599 | 7.5 HIGH | OpenSIPS has vulnerability in the parse_to_param() function |
| CVE-2023-27600 | 7.5 HIGH | OpenSIPS has vulnerability in the codec_delete_XX() functions |
| CVE-2023-27601 | 7.5 HIGH | OpenSIPS has vulnerability in the codec_delete_XX() functions |
| CVE-2023-28095 | 7.5 HIGH | OpenSIPS has vulnerability in the building the local negative replies |
| CVE-2023-28097 | 7.5 HIGH | OpenSIPS has vulnerability in the Content-Length Parser |
| CVE-2023-28098 | 5.9 MEDIUM | OpenSIPS has vulnerability in the Digest Authentication Parser |
| CVE-2023-28099 | 5.9 MEDIUM | OpenSIPS has vulnerability in the ds_is_in_list() function |
IV. Related Vulnerabilities
Same product: opensips
-
CVE-2026-46334
OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS -
CVE-2026-45809
OpenSIPS: Denial of Service in watcherinfo XML generation fr -
CVE-2026-45705
OpenSIPS: OOB Read in Multipart Body Boundary Parsing -
CVE-2026-45537
OpenSIPS: Global Buffer Overflow in construct_uri -
CVE-2026-45103
OpenSIPS: SIP Message Smuggling via TCP Content-Length Integ
Same vendor: OpenSIPS
-
CVE-2026-46334
OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS -
CVE-2026-45809
OpenSIPS: Denial of Service in watcherinfo XML generation fr -
CVE-2026-45705
OpenSIPS: OOB Read in Multipart Body Boundary Parsing -
CVE-2026-45537
OpenSIPS: Global Buffer Overflow in construct_uri -
CVE-2026-45103
OpenSIPS: SIP Message Smuggling via TCP Content-Length Integ
Same weakness: CWE-401
-
CVE-2026-83677
Windows DHCP Client Denial of Service Vulnerability -
CVE-2026-70155
Windows DNS Denial of Service Vulnerability -
CVE-2026-70033
Windows Remote Desktop Gateway (RD Gateway) Denial of Servic -
CVE-2026-109278
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory -
CVE-2026-109270
ImageMagick before 7.1.2-32 Memory Leak via -process Option
V. Comments for CVE-2023-28096
No comments yet