SIPp through version 3.7.7 contains a stack buffer overflow vulnerability in the createAuthHeader() function. The flaw is triggered when the client processes SIP authentication challenges with oversized algorithm parameters, such as in 401 or 407 responses. This vulnerability allows a malicious SIP server to corrupt the stack, leading to a crash of the SIPp client process. The CVSS 3.1 base score is 7.5, indicating a high severity denial-of-service impact with no confidentiality or integrity impact.

The vulnerability can be exploited remotely by an unauthenticated attacker (a malicious SIP server) to cause a denial-of-service by crashing the SIPp client process. There is no indication of confidentiality or integrity compromise. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid interacting with untrusted or malicious SIP servers that may send crafted authentication challenges.