CVE-2025-68274: 
MinimOS vulnerability analysis and mitigation

CVE-2025-68274 is a nil pointer dereference vulnerability in the SIPGO Go library's NewResponseFromRequest function that enables remote, unauthenticated denial-of-service attacks against any SIP application built on the library. It affects SIPGO versions >= 0.3.0 and < 1.0.0-alpha-1. The vulnerability was published on December 16, 2025, with a patch released in version 1.0.0-alpha-1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a NULL Pointer Dereference (CWE-476) combined with Improper Handling of Exceptional Conditions (CWE-755) in sip/response.go at line 242. When a SIP request is received without a To header, the SIP parser accepts the message successfully but leaves the To field as nil in the request object. During response creation, NewResponseFromRequest attempts to access res.To().Params["tag"] without first checking whether res.To() returns nil, triggering a SIGSEGV panic and crashing the application. The fix (commit dc96693) adds a nil guard: if h := res.To(); h != nil { ... } before accessing the Params map (GitHub Advisory, Patch Commit).

Successful exploitation causes an immediate, complete denial of service — the target SIP application crashes with a SIGSEGV panic upon receiving a single malformed packet. Because the vulnerability is triggered during routine SIP operations (call setup, authentication, message handling), any network-accessible SIP service built on the affected SIPGO versions is vulnerable without any special configuration. There is no confidentiality or integrity impact; the sole consequence is total availability loss of the affected SIP service (GitHub Advisory).

A proof-of-concept Python exploit script is publicly available in the GitHub Security Advisory, demonstrating that a single UDP packet with a missing To header is sufficient to crash the target application. No authentication or prior access is required, and the attack can be executed from any network-accessible position. The EPSS score is approximately 0.49%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory).

1. Reconnaissance: Identify SIP services exposed on the network (typically UDP/TCP port 5060) using tools like nmap or SIPVicious. Determine if the target application is built on the SIPGO library (versions 0.3.0–0.x prior to 1.0.0-alpha-1).
2. Craft malformed SIP request: Construct a valid SIP request (e.g., REGISTER) that deliberately omits the To header. All other mandatory headers (Via, From, Call-ID, CSeq, Contact, Content-Length) should be present and syntactically valid.
3. Send the packet: Transmit the malformed SIP message to the target's SIP listener via UDP (or TCP). A single packet is sufficient — no session establishment or prior interaction is needed.
4. Trigger crash: The SIPGO parser accepts the message, then NewResponseFromRequest dereferences the nil To pointer, causing a SIGSEGV panic and immediate application crash.

Example payload structure (Python PoC from advisory):

sip_message = (
    f"REGISTER sip:{target_ip}:{target_port} SIP/2.0\r\n"
    f"Via: SIP/2.0/UDP 192.168.1.100:5060;rport;branch={branch}\r\n"
    f"From: <sip:attacker@example.com>;tag={tag}\r\n"
    f"Call-ID: {call_id}\r\n"
    f"CSeq: 1 REGISTER\r\n"
    f"Contact: <sip:attacker@192.168.1.100>\r\n"
    f"Content-Length: 0\r\n"
    f"\r\n"
)

(GitHub Advisory)

• Network: Single inbound SIP request (any method: REGISTER, INVITE, OPTIONS, etc.) on port 5060 (UDP/TCP) that is missing the To: header field; source IP may be arbitrary and spoofed.
• Logs: Go runtime panic log entry containing panic: runtime error: invalid memory address or nil pointer dereference and [signal SIGSEGV: segmentation violation] referencing sip/response.go:242 and NewResponseFromRequest.
• Process: Unexpected termination of the SIP application process; process restart events in service managers (systemd, supervisord) immediately following receipt of a SIP message.
• Application Logs: Stack trace referencing github.com/emiago/sipgo/sip.NewResponseFromRequest at sip/response.go:242 in crash dumps or stderr output (GitHub Advisory).

Upgrade SIPGO to version 1.0.0-alpha-1 or later, which contains the nil pointer fix in sip/response.go. The patch adds a nil check before accessing To().Params, preventing the crash. No configuration-based workaround is available for the vulnerable code path; upgrading is the only reliable remediation. Organizations should audit all Go-based SIP applications in their environment for dependency on affected SIPGO versions (0.3.0 through < 1.0.0-alpha-1) and prioritize updates given the trivial, unauthenticated exploitability (GitHub Advisory, Patch Commit).

The vulnerability was reported by Sandro Gauci from Enable Security and credited in the patch commit. Red Hat tracked the issue under their CVE database. Coverage appeared across vulnerability aggregators (VulnDB, CVEFeed, CIRCL) and security news outlets shortly after disclosure. No major vendor statements beyond the library maintainer's advisory have been identified (GitHub Advisory, Red Hat CVE).