CVE-2026-121943 · Package
NO FIX YET
sngrep is a terminal tool for capturing and viewing SIP (VoIP signalling) traffic. A crafted UDP or TCP SIP packet, or a malicious pcap file, can crash it or leak nearby stack memory into the displayed SIP fields.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run sngrep to capture or inspect SIP traffic on a network, especially on hosts that see traffic from untrusted networks or that open pcap files from outside sources. Hosts that do not run sngrep, or that only use it on trusted captures, can skip it.
Not affected if not-installed, trusted-captures-only
Who cares self-hosted, sip, sngrep, voip
sngrep --version and compare against the range in the advisory (through 1.9.0).No fix yet, per the sources.
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
This page as .md · .json · in your agent: get_signal("CVE-2026-121943") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.