CVE-2022-41550

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component...

6.5 MediumFix available

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.65%Down 0.2 points since Oct 12, 2022

What each source reports

NVD Score used 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE List 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2022-44742 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: EUVD-2022-44742
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rmjm-5vpx-phrf 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component...

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: GHSA-rmjm-5vpx-phrf
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVALPINE-CVE-2022-41550 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: ALPINE-CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2022-41550 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: DEBIAN-CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-41550 6.5

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.

Record: UBUNTU-CVE-2022-41550
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2022-0389 No score

Updated libosip2 packages fix security vulnerability

GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header. (CVE-2022-41550)

Record: MGASA-2022-0389
Updated: 2026-11-02

OSVopenSUSE-SU-2022:10147-1 No score

Security update for libosip2

This update for libosip2 fixes the following issues:

CVE-2022-41550: Fixed an integer overflow in the header parser (boo#1204225)

Record: openSUSE-SU-2022:10147-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12578-1 No score

libosip2-15-5.3.1-1.1 on GA media

These are all security issues fixed in the libosip2-15-5.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12578-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3724-1 No score

Security update for libosip2

This update for libosip2 fixes the following issues:

CVE-2022-41550: Fixed an integer overflow in osip_body_parse_header (bsc#1204225).

Record: SUSE-SU-2022:3724-1
Updated: 2026-11-02

Affected products

gnu osip

Affected packages

Affected packages
Package	Affected	Fixed
`libosip2` Alpine:v3.20	before 5.3.1-r0	5.3.1-r0
`libosip2` Alpine:v3.21	before 5.3.1-r0	5.3.1-r0
`libosip2` Alpine:v3.22	before 5.3.1-r0	5.3.1-r0
`libosip2` Alpine:v3.23	before 5.3.1-r0	5.3.1-r0
`libosip2` Alpine:v3.24	before 5.3.1-r0	5.3.1-r0
`libosip2` Debian:12	before 5.3.0-2.1	5.3.0-2.1
`libosip2` Debian:13	before 5.3.0-2.1	5.3.0-2.1
`libosip2` Debian:14	before 5.3.0-2.1	5.3.0-2.1
`libosip2` Mageia:8	before 5.0.0-4.1.mga8	5.0.0-4.1.mga8
`libosip2` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 3.5.0-21.3.1	3.5.0-21.3.1

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`libosip2` SUSE:Linux Enterprise Workstation Extension 12 SP5	before 3.5.0-21.3.1	3.5.0-21.3.1
`libosip2` Ubuntu:16.04:LTS	All versions, plus listed versions 4.1.0-24.1.0-2build0.16.04.14.1.0-2+deb8u1build0.16.04.1	None known
`libosip2` Ubuntu:18.04:LTS	All versions, plus listed versions 4.1.0-2.1	None known
`libosip2` Ubuntu:20.04:LTS	All versions, plus listed versions 4.1.0-2.1	None known
`libosip2` Ubuntu:22.04:LTS	All versions, plus listed versions 4.1.0-2.1	None known
`libosip2` Ubuntu:24.04:LTS	All versions, plus listed versions 5.3.0-2.15.3.1-15.3.1-1.15.3.1-1.1build1	None known
`libosip2` Ubuntu:25.10	All versions, plus listed versions 5.3.1-1.1build1	None known
`libosip2` Ubuntu:26.10	All versions, plus listed versions 5.3.1-1.1build2	None known
`libosip2` Ubuntu:26.04:LTS	All versions, plus listed versions 5.3.1-1.1build15.3.1-1.1build2	None known
`libosip2` SUSE:Package Hub 15 SP4	before 5.2.1-bp154.2.3.1	5.2.1-bp154.2.3.1
`libosip2` openSUSE:Leap 15.4	before 5.2.1-bp154.2.3.1	5.2.1-bp154.2.3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41550 is a medium vulnerability (CVSS 6.5) in Gnu Osip, published October 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in libosip2 5.3.1-r0.

References

Show 8 moreShow less