A critical NULL pointer dereference vulnerability in OpenSIPS permits unauthenticated remote attackers to crash the service, resulting in a denial of service for critical communications.

This vulnerability is a NULL pointer dereference (CWE-476) occurring during the parsing or handling of SIP messages. It is accessible to unauthenticated remote attackers, as confirmed by the CVSS vector AV:N/AC:L/AT:N/PR:N.

The ability for a remote attacker to crash a core SIP server with a single crafted request poses a severe threat to organizations relying on OpenSIPS for telephony or messaging. The CVSS score of 8.7 reflects the high impact on availability, which could lead to significant operational downtime and loss of communication capabilities across the enterprise.

Immediate Action: Upgrade to OpenSIPS versions 3.6.6 or 4.0.0-rc1 to resolve the underlying pointer handling flaw.

Proactive Monitoring: Monitor server uptime and process health, specifically tracking restarts of the OpenSIPS daemon which may indicate successful exploitation of this vulnerability.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System capable of identifying and blocking malformed SIP traffic patterns.

Public Exploit Available: No

Organizations should treat this vulnerability with high priority. Given the ease of exploitation, applying the vendor-recommended update is the only effective way to prevent potential service instability caused by malicious remote actors.