{"id":"CVE-2026-77322","kind":"vulnerability","aliases":["CVE-2026-77322","GHSA-8h6x-h86x-75wh","GO-2026-6559"],"related":[],"title":"SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo","description":"SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.","summary":"sipgo is a Go library for building SIP servers, and before 1.4.3 its WebSocket transport reads frames without a size limit. An unauthenticated remote peer can send one frame header declaring a huge payload, which crashes the process or exhausts its memory.","severity":"high","cvss":7.5,"epss":0.00524,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/emiago/sipgo","fixed":["1.4.3"],"affected":"< 1.4.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","sip","voip","websocket"],"not_affected_if":["no-websocket-transport","version-1.4.3-or-later"],"how_to_check":"Run `go list -m github.com/emiago/sipgo` in each service and check whether the version is below 1.4.3.\nSearch the codebase for sipgo transport usage over WS or WSS.","fix":"Upgrade github.com/emiago/sipgo to 1.4.3 or later and rebuild.","status":"open","published_at":"2026-09-22T20:17:08+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:30+00:00","updated_at":"2026-10-23T21:45:30+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:45:30Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/emiago/sipgo to 1.4.3 or later and rebuild.\nunknown","reach":"internet","impact":"medium","summary":"sipgo is a Go library for building SIP servers, and before 1.4.3 its WebSocket transport reads frames without a size limit. An unauthenticated remote peer can send one frame header declaring a huge payload, which crashes the process or exhausts its memory.","category":"package","who_cares":["go","sip","websocket","voip"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote peer crashes server process or exhausts its memory","analyst_note":"","how_to_check":"Run `go list -m github.com/emiago/sipgo` in each service and check whether the version is below 1.4.3.\nSearch the codebase for sipgo transport usage over WS or WSS.\nunknown","needs_analyst":false,"not_affected_if":["no-websocket-transport","version-1.4.3-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000491,"input_tokens":3015,"output_tokens":378,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A,24A '-6559':22A '-77322':14A,25A '/emiago/sipgo':11A,28A '1.4.3':45B,90C,158C '75wh':19A '8h6x':17A 'accept':103C 'alloc':132C 'allow':100C 'appli':112C 'build':40B 'caus':129C 'client':106C 'client-control':105C 'control':107C 'crash':69B,144C 'creat':94C 'cve':12A,23A 'declar':64B,124C 'dos':2A 'exhaust':73B,146C 'extrem':126C 'fix':155C 'frame':6A,50B,62B,122C 'ghsa':16A 'ghsa-8h6x-h86x-75wh':15A 'github.com':10A,27A 'github.com/emiago/sipgo':9A,26A 'go':20A,29B,37B,86C 'h86x':18A 'header':63B,123C 'header.length':108C 'huge':66B 'issu':153C 'languag':87C 'larg':127C 'length':7A,136C 'librari':38B,79C 'limit':54B 'makeslic':135C 'maxframes':99C 'memori':75B,147C 'nextfram':101C 'one':61B 'overs':131C 'packag':30B 'panic':137C 'parsemaxmessagelength':110C 'payload':67B,128C,140C 'peer':58B,118C 'prior':88C 'process':71B,151C 'read':49B,142C 'remot':57B 'send':60B,120C 'server':42B,150C 'servic':83C 'set':98C 'sip':31B,41B,82C 'sip/transport_ws.go':93C 'sipgo':1A,34B,76C 'size':53B 'transport':48B 'unauthent':56B,114C 'unvalid':4A 'version':157C 'via':3A 'voip':32B 'websocket':5A,33B,47B 'without':51B,97C 'write':81C 'ws':115C 'wsconnection.read':91C 'wss':117C 'wsutil.reader':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T20:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6559","url":"https://pkg.go.dev/vuln/GO-2026-6559","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77322","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77322","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77322","severity":null,"published_at":"2026-09-22T20:17:08+00:00","modified_at":"2026-09-23T18:12:04+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}