CVE-2026-90558

sngrep: sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header...

CVE-2026-90558 is fixed in sngrep on 1 platform by DEBIAN-CVE-2026-90558 (version 1.8.4-2), released September 18, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine

CVSS

n/a

No vendor severity

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0088

59th percentile

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
sngrep · Debian 14	1.8.4-2	DEBIAN-CVE-2026-90558	Sep 18, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.