PT-2025-51791 · Sipgo · Sipgo

Published 2025-12-16 · Updated 2026-03-05 · CVE-2025-68274

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SIPGO versions 0.3.0 through 1.0.0-alpha-1

Description SIPGO is a library for writing SIP services in the GO language. A nil pointer dereference exists in the NewResponseFromRequest function, impacting normal SIP operations. This allows a remote attacker to crash a SIP application by sending a malformed SIP request lacking a To header. The issue arises because the response creation code assumes the To header exists without checking if it is nil, even when SIP message parsing succeeds for a request missing the To header. This affects routine operations such as call setup, authentication, and message handling.

Recommendations Versions prior to 1.0.0-alpha-1 should be updated to version 1.0.0-alpha-1 or later.

Exploit

Fix

DoS

Improper Handling of Exceptional Conditions

NULL Pointer Dereference

Weakness Enumeration

CWE-755

CWE-476

Related Identifiers

CVE-2025-68274

GHSA-C623-F998-8HHV

GO-2025-4244

SUSE-SU-2026:0037-1

Affected Products

Sipgo

References · 91

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68274.json · Exploit
• 🔥 https://github.com/emiago/sipgo/security/advisories/GHSA-c623-f998-8hhv · Exploit
• https://github.com/emiago/sipgo/commit/dc9669364a154ec6d134e542f6a63c31b5afe6e8 · Patch
• https://osv.dev/vulnerability/GO-2025-4244 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c623-f998-8hhv · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68274 · Security Note
• https://github.com/emiago/sipgo · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note