CVE-2025-68274
📋 TL;DR
A nil pointer dereference vulnerability in SIPGO library's NewResponseFromRequest function allows remote attackers to crash SIP applications by sending a single malformed SIP request without a To header. This affects all SIP applications using the vulnerable library versions for routine operations like call setup and authentication. The vulnerability is triggered when parsing succeeds for requests missing the To header but response creation assumes its existence without proper nil checks.
💻 Affected Systems
- SIPGO library
- Any SIP application built with SIPGO library
📦 What is this software?
Sipgo by Emiago
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for SIP services, disrupting voice/video communications, authentication systems, and messaging functionality across affected applications.
Likely Case
Service crashes and restarts causing intermittent service disruption, potentially leading to call drops, failed authentications, and degraded SIP service availability.
If Mitigated
Minimal impact with proper network controls and monitoring; crashes would be detected and services could auto-restart with minimal downtime.
🎯 Exploit Status
Exploitation requires only sending a single malformed SIP request without a To header. No authentication or special conditions needed. The simplicity makes weaponization highly likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0-alpha-1
Vendor Advisory: https://github.com/emiago/sipgo/security/advisories/GHSA-c623-f998-8hhv
Restart Required: Yes
Instructions:
1. Update SIPGO dependency to version 1.0.0-alpha-1 or later
2. Run 'go get github.com/emiago/sipgo@v1.0.0-alpha-1'
3. Rebuild and redeploy your SIP application
4. Restart all affected services
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement custom wrapper around NewResponseFromRequest that validates To header exists before calling the vulnerable function
// Go code example:
func SafeNewResponseFromRequest(req *sip.Request) (*sip.Response, error) {
if req.To == nil {
return nil, errors.New("missing To header")
}
return sip.NewResponseFromRequest(req)
}
🧯 If You Can't Patch
- Implement network-level filtering to block SIP requests without To headers using SIP-aware firewalls or WAFs
- Deploy rate limiting and anomaly detection to identify and block malformed SIP request patterns
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for SIPGO dependency version. If version is >=0.3.0 and <1.0.0-alpha-1, the application is vulnerable.Check Version:
grep -i sipgo go.mod || grep -i sipgo go.sumVerify Fix Applied:
Verify SIPGO version is 1.0.0-alpha-1 or later in go.mod and test with malformed SIP requests (without To header) to ensure service doesn't crash.📡 Detection & Monitoring
Log Indicators:
- Application crashes/panics with nil pointer dereference errors
- SIP service restarts without clear cause
- Error logs mentioning 'panic', 'nil pointer', or 'To header'
Network Indicators:
- SIP requests without To headers in network traffic
- Abnormal SIP message patterns from single sources
- Spike in malformed SIP packets
SIEM Query:
source="application.logs" AND ("panic" OR "nil pointer" OR "To header") AND process="sip_application"