[OpenSIPS-Devel] [OpenSIPS/opensips] 17e16a: jabber: bound conference presence address

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 17e16a0302fc41624d7b721a4e5622587b539444
      https://github.com/OpenSIPS/opensips/commit/17e16a0302fc41624d7b721a4e5622587b539444
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-17 (Thu, 17 Sep 2026)

  Changed paths:
    M modules/jabber/xjab_jcon.c

  Log Message:
  -----------
  jabber: bound conference presence address

Reject conference addresses whose room, server, and nick exceed the presence buffer before copying them.

Fixes GHSA-7xv8-ff5m-99ww: https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7xv8-ff5m-99ww

Thanks to @kta1kri for reporting this issue.

(cherry picked from commit 3d3a59db4a9edc19a8ec5820e90770ded09265e9)



To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications