CVE-2025-68274
Description
SIPGO is a library for writing SIP services in the GO language. Starting in version 0.3.0 and prior to version 1.0.0-alpha-1, a nil pointer dereference vulnerability is in the SIPGO library's `NewResponseFromRequest` function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header. The vulnerability occurs when SIP message parsing succeeds for a request missing the To header, but the response creation code assumes the To header exists without proper nil checks. This affects routine operations like call setup, authentication, and message handling - not just error cases. This vulnerability affects all SIP applications using the sipgo library, not just specific configurations or edge cases, as long as they make use of the `NewResponseFromRequest` function. Version 1.0.0-alpha-1 contains a patch for the issue.
How to fix
- emiago sipgo1.0.0 or later
- github.com/emiago/sipgo1.0.0-alpha-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emiago sipgo | 0.30.0 ≤ v < 1.0.0 | 1.0.0 |
| github.com/emiago/sipgoGo | 0.3.0 ≤ v < 1.0.0-alpha-1, v < 1.0.0-alpha-1 | 1.0.0-alpha-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.