{"id":"CVE-2026-121943","kind":"vulnerability","aliases":["CVE-2026-121943"],"related":[],"title":"sngrep: off-by-one SIP packet check lets remote senders crash it","description":"Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.","summary":"sngrep is a terminal tool for capturing and viewing SIP (VoIP signalling) traffic. A crafted UDP or TCP SIP packet, or a malicious pcap file, can crash it or leak nearby stack memory into the displayed SIP fields.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","sip","sngrep","voip"],"not_affected_if":["not-installed","trusted-captures-only"],"how_to_check":"- Run `sngrep --version` and compare against the range in the advisory (through 1.9.0).\n- Check whether sngrep runs on hosts that capture live SIP traffic from untrusted networks, or opens pcap files from outside sources.","fix":null,"status":"open","published_at":"2026-11-04T13:17:28+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","triaged_at":"2026-11-04T13:28:09+00:00","updated_at":"2026-11-04T13:28:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T13:28:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"sngrep: off-by-one SIP packet check lets remote senders crash it","impact":"low","summary":"sngrep is a terminal tool for capturing and viewing SIP (VoIP signalling) traffic. A crafted UDP or TCP SIP packet, or a malicious pcap file, can crash it or leak nearby stack memory into the displayed SIP fields.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sngrep","sip","voip","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"sngrep crashes, or leaks adjacent stack bytes into displayed fields","analyst_note":"Check the vendor or upstream sngrep repository for a fixed version; the sources only give the affected range through 1.9.0 and a third-party advisory link.","how_to_check":"- Run `sngrep --version` and compare against the range in the advisory (through 1.9.0).\n- Check whether sngrep runs on hosts that capture live SIP traffic from untrusted networks, or opens pcap files from outside sources.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","trusted-captures-only"],"who_is_affected":"Teams that run sngrep to capture or inspect SIP traffic on a network, especially on hosts that see traffic from untrusted networks or that open pcap files from outside sources. Hosts that do not run sngrep, or that only use it on trusted captures, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4190,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121943':15A,18A '-2026':14A,17A '1.9.0':67C '10240':95C 'adjac':120C 'attack':100C 'bound':73C 'byte':96C,122C 'captur':32B 'caus':85C 'check':8A,79C,93C 'contain':68C 'craft':40B,104C 'crash':12A,52B,116C 'cve':13A,16A 'display':61B,124C 'field':63B,126C 'file':50B,114C 'host':22B 'irontec':64C 'leak':55B,119C 'length':92C 'let':9A 'malici':48B 'memori':58B 'nearbi':56B 'off-by-on':2A,88C 'one':5A,91C 'out-of-bound':70C 'packag':19B 'packet':7A,45B,80C,84C,109C 'payload':98C 'pcap':49B,113C 'read':75C 'remot':10A,99C 'self':21B 'self-host':20B 'send':102C 'sender':11A 'signal':37B 'sip':6A,23B,35B,44B,62B,78C,82C,97C,108C,125C 'sngrep':1A,24B,26B,65C,117C 'stack':57B,74C,121C 'suppli':111C 'tcp':43B,107C 'termin':29B 'tool':30B 'traffic':38B 'udp':41B,105C 'valid':83C 'view':34B 'voip':25B,36B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams that run sngrep to capture or inspect SIP traffic on a network, especially on hosts that see traffic from untrusted networks or that open pcap files from outside sources. Hosts that do not run sngrep, or that only use it on trusted captures, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","sip","sngrep","voip"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121943","severity":null,"published_at":"2026-11-04T13:17:28+00:00","modified_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","fetched_at":"2026-11-04T13:27:03+00:00","note":null}],"documents":[{"id":67091,"url":"https://www.vulncheck.com/advisories/irontec-sngrep-through-1.9.0-out-of-bounds-stack-read-via-sip-check-packet","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}