OpenSIPS 3.6.10 ChangeLog

Released on October 28, 2026

OpenSIPS 3.6.10 is a maintenance release for the 3.6 stable branch, bringing TCP and WebSocket stability fixes, parser and input safety improvements, dialog, B2B and SIPREC corrections, RTP handling fixes, and safer SIP capture.

This release includes a fix for a remotely triggerable STIR/SHAKEN double-free on Identity headers with unsupported ppt values, as well as buffer overflows, out-of-bounds access, memory corruption and concurrency issues. Upgrading is strongly recommended.

This changelog summarizes changes since 3.6.8. Related fixes are grouped by subsystem; release mechanics and documentation-only changes are summarized.

Core, Memory and TCP Stability

  • Guarded TCP connection lookups after shutdown. 38ac63c62c
  • Fixed physical fragment links after defragmentation in the f_malloc memory allocator. c6858cc1b1
  • Bounded socket string construction, including long advertised hostnames and socket tags, to prevent startup buffer overflows. aa8b9f3db4
  • Reset TCP tracing state before each send and reported the correct ports and connection ID when TLS writes are queued during async connection establishment. 5c872c07e5 6daee18097
  • Freed time recurrence allocations. e99921ce71

Parsing and Input Safety

  • Fixed a remotely triggerable STIR/SHAKEN double-free when rejecting Identity headers with unsupported ppt values (other than ppt=shaken). Unified parsed Identity cleanup while retaining the memory-leak fix. b4ad73ca9c
  • Fixed multipart body parsing bounds and negative body-part length calculations. 672907ec50 e87893ac1d
  • Handled commas and escaped characters in quoted Via parameter values, rejecting truncated or invalid quoted escapes. 65fbcc4668 8b4df3319d
  • Bounded lookahead when parsing Supported option tags, Session-Expires refresher parameters and escaped URI user characters. d57b92d048 9ebebed56f b5000785e4 03a6b43f0f
  • Corrected Call-Info header size calculations in b2b_sca. 0a09ead0d7
  • Validated ISUP parameter lengths, MSRP To-Path header ordering and Identity header copy lengths. 2b5b3f431e 4794414d7a 473bf476a5
  • Rejected oversized XMPP URI and Jabber conference presence addresses, and kept domainpolicy destination URI buffer lengths consistent. 3d00045abc e14016db1e 55de95748c 8b9fff80d6
  • Fixed an out-of-bounds read in RTPProxy DTMF tags and validated SDP connection IP lengths in sngtc. a72edc8de8 c47d47da73

TLS and WebSocket Handling

  • Waited for TLS handshake completion before further WSS I/O. 78b0f3d346
  • Included the peer address in failed WebSocket server handshake logs. bd12fc67db

Dialog, B2B and SIPREC

  • Stored INVITE CSeq maps on the source dialog leg so ACKs for callee-initiated re-INVITEs recover the relayed CSeq. 0ddf7b9c60
  • Handled dialog callbacks without a processing context and treated replicated values for missing dialogs as a no-op. d869c6e112 2b0726e393
  • Fixed B2B client dialog access after sending a request, copied callback keys before unlocking, and avoided lock inversion through local routes. 84bb4f703c 47e8e95ed5 ff62a32b7f
  • Protected B2B SDP demultiplexing structures during callbacks and stream release, allowed reply-route body changes in b2b_logic, and corrected B2B ACK tracing. e1365b8a6b 6b116aa526 211b5e373c 0e2fe96aaf
  • Kept SIPREC contexts alive until dialog destruction, held session references through request processing, and released sessions when the recording server answered after the call ended. 1f3b842d06 615c37914f 114e8018ca
  • Avoided a SIPREC context lock self-deadlock. c4b93ac610
  • Preserved Contact header syntax in topology hiding and stored socket tags where available so peer nodes can decode socket information. b328ee46db d8eec3b500

RTP and Media Handling

  • Fixed RTP relay context reference ownership, including stateless replies after engagement, in-dialog callbacks and B2B tuples. 393900ce4a 163ae1b4b9 b9d278acdd
  • Kept the all-branches RTP session across a failed branch, allowed B2B engagement without a dialog, and gave callers their own copy of the route engine body. 6412d7ff59 9622bc6077 36a3428a1b
  • Fixed rtpengine/bencode heap corruption, descriptor cleanup and out-of-memory handling. 9e156396ca
  • Restored the rtpengine from-tag on delete, avoided unknown no-from-tag arguments and preserved unchanged relay nodes. 826fc99f47 8ddbff534b 0cc7214dd7
  • Corrected media-exchange leg selection and SDP pseudo-variable logging. 643200bce5 af709e392d

Transactions, Registration and Presence

  • Serialized reply lump access in t_reply_with_body(), fixed transaction lump leaks across async/failure routes, and fixed shared script-route reference double frees. 6819fc2784 a94dc2a424 f2f58962f9 53474a9727
  • Suppressed later async resume attempts for jobs that had already fallen back to synchronous execution. a7c32d90e5
  • Randomized registrar expiration values within the allowed band, avoiding concentrations at min_expires and max_expires. 0c3ef5acde
  • Fixed pua_dialoginfo dangling branch cleanup and synthetic reply handling, preserved answered branches, and honored custom callees and branch muting during cleanup. 5555feb1aa 57215d1695 32cfa06d25 e0fab2beea
  • Reduced spurious usrloc replication errors for empty key/value data. b1662d9436

SIP Capture and HEP Safety

  • Escaped string/blob values in batched async capture inserts, corrected report column counts and kept PostgreSQL query strings terminated. bdc30b8564
  • Bounded batched capture queries and corrected capture column indexing. 58dad02797
  • Kept RTCP report Event data alive until storage, validated its type and checked custom HEP chunk lengths before typed reads. 001b279bdb
  • Bounded rebuilt HEP relay packets and used a separate relay buffer to avoid overlapping payload copies. 9b4b91d787
  • Freed decompressed HEPv3 payloads. 474aa1f5cb

Module Fixes, Builds and Documentation

  • Used thread-safe allocation in AAA Diameter worker callbacks and restricted cJSON shared-memory hooks to operations requiring them. 4fa00094dd
  • Fixed SQL cache reload-version initialization races and masked database URL passwords in sqlops connection errors. 88a254c876 95c5d32112
  • Fixed CGRateS busy loops on EAGAIN and empty session tag persistence, and handled accounting callbacks without a processing context. b84ccb015b a967a1f7b1 59b85ad34b
  • Fixed Kafka send-job double frees and RabbitMQ persistent event publishing and broken stream cleanup. 3081860566 4b71292efa cc3c36d76f
  • Stripped RFC 4904 user parameters from STIR/SHAKEN telephone numbers and avoided duplicate Identity parse-error cleanup. 2adcda88cb b4ad73ca9c
  • Corrected AKA authentication vector sizing, bounded Redis subkey argument arrays and initialized the domain subdomain column with its own length. 643200bce5 7a9417ac06
  • Supported legacy MongoDB headers and corrected radcli builds and MySQL packaging dependencies on EL10. de799e2cb2 079e5851a3 f800e7f627
  • Corrected out-of-range tracing log-level handling and refreshed module documentation names, parameter types, examples and references; documented the MI version revision parameter. 4ad8bb03da 1c3f8c102c 7b30144b78 549bcf0a5c 868268d9de