NULL pointer dereference in Emiago Sipgo
CVE-2025-68274
SIPGO is a library for writing SIP services in the GO language. Starting in version 0.3.0 and prior to version 1.0.0-alpha-1, a nil pointer dereference vulnerability is in the SIPGO library's `NewResponseFromRequest` function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header. The vulnerability occurs when SIP message parsing succeeds for a request missing the To header, but the response creation code assumes the To header exists without proper nil checks. This affects routine operations like call setup, authentication, and message handling - not just error cases. This vulnerability affects all SIP applications using the sipgo library, not just specific configurations or edge cases, as long as they make use of the `NewResponseFromRequest` function. Version 1.0.0-alpha-1 contains a patch for the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.005 · change: -0.000
Affected products
- Emiago Sipgo — versions >= v0.3.0, < v1.0.0-alpha-1
Weakness classification (CWE)
References
- github.com/emiago/sipgo/security/advisories/GHSA-c623-f998-8hhv (Exploit, Vendor Advisory)
- github.com/emiago/sipgo/commit/dc9669364a154ec6d134e542f6a63c31b5afe6e8 (Patch)
Frequently asked questions
- What is CVE-2025-68274?
- CVE-2025-68274 is a high-severity vulnerability in Emiago Sipgo, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2025-12-16.
- How severe is CVE-2025-68274?
- High severity. CVSS v3 base score is 7.5 out of 10.