{"id":"EUVD-2026-84818","enisaUuid":"57f42a02-d7d0-3be0-9507-58b418a140ee","description":"SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.","datePublished":"Sep 22, 2026, 7:52:12 PM","dateUpdated":"Sep 23, 2026, 3:08:21 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh\nhttps://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc\nhttps://github.com/emiago/sipgo/releases/tag/v1.4.3\n","aliases":"CVE-2026-77322\nGHSA-8h6x-h86x-75wh\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"91ef0301-f05a-379a-ad77-0818a80da5d0","product":{"name":"sipgo","vendor":{"name":"emiago"}},"product_version":"\u003c 1.4.3"}],"enisaIdVendor":[{"id":"1a41f7ec-054a-33ff-b00a-df854a99284b","vendor":{"name":"emiago"}}],"enisaIdVulnerability":[{"id":"c1575cc2-766a-392c-92d0-df622be2df71","vulnerability":{"id":"GHSA-8h6x-h86x-75wh","description":"SIPGO: DoS via unvalidated WebSocket frame length","datePublished":"Sep 22, 2026, 8:34:30 PM","dateUpdated":"Sep 22, 2026, 8:34:30 PM","baseScore":0.0,"references":"https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh\nhttps://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc\nhttps://github.com/emiago/sipgo\nhttps://github.com/emiago/sipgo/releases/tag/v1.4.3\n","enisa_id":"EUVD-2026-84818\n","aliases":"CVE-2026-77322\nGHSA-8h6x-h86x-75wh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cfdb9842-c01f-3bfb-872b-ee7baffa6a27","vulnerability":{"id":"CVE-2026-77322","description":"SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.","datePublished":"Sep 22, 2026, 7:52:12 PM","dateUpdated":"Sep 23, 2026, 3:08:21 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh\nhttps://github.com/emiago/sipgo/commit/769e4bc958376e2363566c8f7042202b410becdc\nhttps://github.com/emiago/sipgo/releases/tag/v1.4.3\n","enisa_id":"EUVD-2026-84818\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Oct 28, 2026, 7:15:15 AM","vulnerabilityProduct":[{"id":"54163ead-e7e9-329f-940a-3c1124746a7c","product":{"name":"sipgo","vendor":{"name":"emiago"}},"product_version":"\u003c 1.4.3"}],"vulnerabilityVendor":[{"id":"864dc928-c6ad-3d2d-98c4-d42562343d34","vendor":{"name":"emiago"}}]}}],"enisaIdAdvisory":[]}