CVE-2026-90558Critical· 9.8▾ Midnightsngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.9%
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2304High· 7.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVE-2026-101003Medium· 5.3A weakness has been identified in Cesanta Mongoose up to 7.21
CVE-2025-9820Medium· 4.0A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization
CVE-2025-6170Low· 2.5A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files
CVE-2025-5278Medium· 4.4A flaw was found in GNU Coreutils
CVE-2025-71407High· 8.1Rejected reason: This CVE ID has been rejected as a duplicate.