SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2025-68274: 0.55% estimated exploitation activity in the next 30 days; percentile 45.88 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Description A nil pointer dereference vulnerability was discovered in the SIPGO library's NewResponseFromRequest function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header. The vulnerability occurs when SIP message parsing succeeds for a request missing the To header, but the response creation code assumes the To header exists without proper nil checks. This affects routine operations like call setup, authentication, and message handling - not just error cases. Note: This vulnerability affects all SIP applications using the sipgo library, not just specific configurations or edge cases, as long as they make use of the NewResponseFromRequest function. Technical details The vulnerability is located in /sip/response.go at line 242 in the NewResponseFromRequest function: Root Cause: 1. Missing To Header: When any SIP request is sent without a To header, the SIP…

Published by the source

16 Dec 2025, 21:24 UTC

Last modified by the source

20 Dec 2025, 03:33 UTC

Source last checked

26 Oct 2026, 15:13 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-c623-f998-8hhv

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-68274

Advisory: SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference
IDs: CVE-2025-68274, GHSA-c623-f998-8hhv
Record: https://patchnext.com/advisories/cve-2025-68274 (revision 1, source checked 26 Oct 2026, 15:13 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/emiago/sipgo 1.0.0-alpha-1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/emiago/sipgo: affected >= 0.3.0, < 1.0.0-alpha-1; fixed in 1.0.0-alpha-1

## Suggested inspection (read-only)
- Go github.com/emiago/sipgo: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/emiago/sipgo.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-c623-f998-8hhv (GitHub-reviewed advisory GHSA-c623-f998-8hhv lists affected ranges: Go github.com/emiago/sipgo >=0.3.0 <1.0.0-alpha-1)

Commands are suggestions: review each one before running it.