CVE-2026-77322 HIGH

CVE-2026-77322: SIPGO: DoS via unvalidated WebSocket frame length

Vendor Emiago

Product sipgo

Weakness CWE-789

Published September 22, 2026

Last update September 22, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.

Key dates

02Disclosure timeline

September 22, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-77322 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/789.html AskarLabs — CWE-789 write-up Memory Allocation with Excessive Size Value