OpenSIPS 4.0.0-rc1 ChangeLog

Released on May 20, 2026

OpenSIPS 4.0.0-rc1 is the first release candidate for the 4.0 series and also carries the coordinated security hardening released for the maintained stable branches. It includes malformed-input handling, bounds checks and buffer-safety fixes, plus several 4.0-specific polish items after the beta.

This release is security-focused and is recommended for all 4.0 beta testers and early adopters.

This changelog summarizes the user-visible changes from 4.0.0-beta..4.0.0-rc1 and omits generated documentation rebuilds, version bumps and release mechanics.

Security Hardening and Input Bounds

  • Added broad bounds checks for input-derived lengths in core and parser paths, including base64 transformation output sizing, multipart body delimiter parsing, TCP Content-Length arithmetic, SIP-to-JSON header names and URI construction. 5f103effaf
  • Fixed SIP compression buffer accounting so preserved headers are rebuilt from the same normalized fields used during size calculation, avoiding overflow on headers with extra whitespace. 9a8499142c
  • Fixed decompression bounds checks in the compression module. 4232171dfc
  • Bound the parsed SDP line count and rejected malformed SDP bandwidth lines before they can trigger unsafe parsing behavior. a2f621c8a9 ac5309d5b8
  • Fixed cachedb contact matching in usrloc by using the correct match key size, and fixed a possible shared-memory leak in usrloc clustering. d703b76c74 7b5745d62f

Protocol Modules

  • Hardened SMPP string handling and bounded attacker-controlled sm_length values before GSM7/UCS2 decoding, fixing overflows reachable from malicious SMSC peers. d2363d31dc c5af7f7f5b
  • Validated HEPv3 packet and chunk lengths and rejected HEPv3 frames without payload before callbacks or SIP parsing consume invalid payload state. 99669a9019 06712cb5d9
  • Validated received BIN packet bounds and cleaned up packet-size logging/portable size printing. 00c434d32c d7d905586d f9ee95a8e9
  • Validated resolved address families in jabber and xmpp before using resolved targets. 8c2614afec 47bb121fb0
  • Fixed an out-of-bounds access in pi_http POST argument handling. ec9f4425e4

Presence, IMC and Messaging

  • Fixed a presence winfo XML overflow on long URIs. dd86461b71
  • Made presence parsing robust when Content-Type is missing, and ensured type/subtype checks happen after parsing. 73279c3fe9 91e13270ed
  • Fixed IMC member-list buffer overflow by building replies into exact-sized buffers and rejecting oversized unknown-command replies. 1cef34147d d3c4b6da76 80340bae31

Routing and Dialog Modules

  • Dynamically grows temporary GRUU reply buffers in registrar instead of relying on fixed-size assumptions. 73230d7503
  • Bounded accounting AVP collection in aaa_diameter and topology packet counts in clusterer. d8ac1ba5b9 0a728fd6e8
  • Stopped oversized Replaces rewriting in b2b_logic and bounded generated RAck headers in b2b_entities. 5844e56613 61d6152d8a
  • Bounded encoded Contact handling in topology_hiding and maddr URI construction in rr. 626112c9aa 5589fb1cd9
  • Fixed topology_hiding crash behavior when th_callid_loop_protection is disabled. 3e99d46c96
  • Fixed rtpengine pvar reset behavior, IPv6 destination handling and enforced-server loop avoidance. a6f2cf7b87 4c98c4c2de ed018c349b

4.0 RC Polish and Beta Follow-Ups

  • Completed Push Notification assisted branch handling fixes and added related registrar unit-test coverage for the 4.0 codebase. fb7e5c41db 293d7e716f d17fb7df6c
  • Improved registrar error handling. 749bf9f305
  • Preserved the b2b_entities leg index when answering calls using the pass-legs-upstream flag. 2c0e549f93
  • Fixed aaa_diameter cJSON reply ownership in dm_send_request() paths. 4bdab3954b
  • Removed an unnecessary OpenTelemetry dependency on the pt.h module. feb57fa516
  • Improved 4.0 documentation around PRACK handling, load_dialog_ctx() and TCP connection closing. 02b0ae7e59 ee5c1a6cff 855f3e1437

Runtime, Portability and Build Fixes

  • Fixed 32-bit architecture format-specifier warnings using portable C99 format specifiers and related inttypes updates. c2e75946b9 703e8b5264
  • Limited -Wno-atomic-alignment usage to clang builds. 510ce80f08
  • Removed deprecated XML memory-dump calls from presence code. baf0645ef5
  • Updated GitHub Actions versions, improved Debian 13 Python compatibility and fixed a missing cgrates module-parameter dependency terminator. e0511d43c4 0760df09b9 bfe3896b84