This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-90558 →

DEBIAN-CVE-2026-90558

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer...

Original description

The description as published by the source.

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 sngrep

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 sngrep

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 sngrep

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-2"}]}]

References

advisory security-tracker.debian.org