CVE-2026-46334 is a denial-of-service vulnerability in OpenSIPS where a malformed SDP bandwidth line (b=) causes a worker process to crash. The root cause is a missing colon delimiter check during SDP parsing — when the parser encounters a bandwidth field without the expected 'b=<type>:<value>' format, it produces corrupted metadata that doesn't crash the parser itself but causes a crash later when the dialog module attempts to clone that corrupted state. This is a parsing-to-state-propagation failure: the validation boundary is in the wrong place. The system accepts malformed input at parse time and only fails when downstream code attempts to consume it.
The vulnerability is remotely triggerable without authentication on any OpenSIPS configuration that processes SDP and uses the dialog or QoS modules — a common VoIP proxy setup. A single malformed packet crashes one worker process, but in a deployed SIP proxy this cascades: in-flight calls fail, registrations drop, and downstream proxies receive orphaned INVITE dialogs with no termination signal. The EPSS score is low (0.00488), but that metric measures exploitation probability in isolation — it doesn't account for the infrastructure blast radius. A DoS against a SIP proxy is operationally severe regardless of exploitation frequency.
Upgrade to OpenSIPS 3.6.6, which adds the missing colon check in the bandwidth line parser. However, the more important question is whether other SDP field parsers have the same loose coupling between parser output and internal state model. The fix addresses this specific field, but the underlying architectural issue — parser code that can produce outputs which downstream modules cannot safely consume — may exist in other parsing paths. Review whether your OpenSIPS deployment has other custom or third-party modules consuming SDP parsed data, and verify that those consuming modules have their own validation layers rather than trusting parser output as well-formed.
From a defensive operations standpoint, treat this as a reminder that SIP proxies face untrusted network input and should fail-safe on malformed packets rather than propagating corrupted state. Monitor your SIP infrastructure for patterns of worker restarts that correlate with specific SDP characteristics — a spike in worker crashes following SIP invite processing with unusual bandwidth fields may indicate exploitation attempts against this or similar vulnerabilities.