CVE-2026-45084 is a NULL pointer dereference in OpenSIPS 3.4.0 through 3.6.5's presence module, and it deserves more attention than a typical DoS vulnerability warrants. The crash itself is gated behind enable_sphere_check=1, a non-default configuration option — which means this is not a universal exposure, but rather a vulnerability that strikes the subset of deployments that explicitly enabled this flag as a hardening measure against presence-based abuse. That inversion is the first thing to internalize: the population most likely to have enabled this option is also the population most likely to be monitoring their systems, yet they're the ones exposed.
The technical root cause is a state machine violation, not memory corruption. The presence module calls get_content_type() expecting msg->content_type->parsed to contain a valid structure, but the code path never invoked parse_content_type_hdr() to populate that state. This is the classic "parse-on-demand" failure: parsing happens lazily, only when some call site happens to need it, creating invisible temporal dependencies between initialization and access. The get_content_type() macro doesn't return state — it dereferences it directly, making the assumption of pre-parsing syntactically invisible at the call site. A developer adding enable_sphere_check validation code inherited that assumption without auditing it, and the new code path triggered the latent bug.
Two crash variants exist: NULL pointer dereference and NULL struct member dereference. That inconsistency suggests the underlying state management was already broken in ways that manifested differently depending on call context. More concerning than either crash variant is the likelihood of silent behavioral anomalies — wrong Content-Type interpretation, presence document corruption, or failed XCAP updates that the server swallows without error. The version range spans two and a half years and over twenty minor releases with no reported crashes before this CVE, which implies silent variants could have been active far longer than the crash evidence suggests.
For defenders: audit your OpenSIPS configurations for enable_sphere_check=1. If it's enabled, treat this as a priority patch regardless of your threat model — the configuration was explicitly added to harden presence handling, so its exposure is a deliberate hardening choice that now backfires. More broadly, examine modules where configuration flags conditionally enable getter-macro access — those flags are the mutation points where silent assumptions about parsing state get stress-tested. The CVSS scope is DoS, but the blast radius of silent corruption extends to every presence subscription and notification downstream of the corrupted state.