Coreycbc created an issue (kamailio/kamailio#4839) ### Description Following maintainer guidance, I am opening this as a feature request / conformance hardening issue rather than a security vulnerability report. Kamailio 6.1.3 accepts some out-of-range `CSeq` sequence numbers through `sanity_check("1511", "7")`. RFC 3261 Section 8.1.1.5 says that, for non-REGISTER requests outside a dialog, the CSeq sequence number must be expressible as a 32-bit unsigned integer and must be less than `2**31`. ### Expected behavior Out-of-range `CSeq` values should be rejected by the sanity module, preferably with `400 Bad Request` / `CSeq number is illegal`. #### Actual observed behavior For a non-keepalive Request-URI such as `sip:33@127.0.0.1`: - `CSeq: 2147483648 OPTIONS` -> 20/20 responses: `404 Not Found` - `CSeq: 4294967296 OPTIONS` -> 20/20 responses: `404 Not Found` - Boundary control, `CSeq: 4294967297 OPTIONS` -> 5/5 responses: `400 CSeq number is illegal` The `404 Not Found` responses indicate that the requests passed the initial syntax checks and reached routing logic, instead of being rejected as malformed requests. #### Debugging Data ```text Target: Kamailio 6.1.3 Commit: dc45707fc9e91d40a555140f4f352ed94b70d582 Configuration: ProfuzzBench basic Kamailio configuration Transport: UDP, local-only test on 127.0.0.1 Observed: CSeq: 2147483648 OPTIONS -> 20/20 responses: 404 Not Found CSeq: 4294967296 OPTIONS -> 20/20 responses: 404 Not Found CSeq: 4294967297 OPTIONS -> 5/5 responses: 400 CSeq number is illegal #### Log Messages No relevant syslog messages collected. The behavior was confirmed from SIP responses. #### SIP Traffic OPTIONS sip:33@127.0.0.1 SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK-probe-1 From: <sip:30@127.0.0.1>;tag=probe-from To: <sip:33@127.0.0.1> Call-ID: probe-1@127.0.0.1 CSeq: 2147483648 OPTIONS Max-Forwards: 70 Content-Length: 0 Observed response: SIP/2.0 404 Not Found OPTIONS sip:33@127.0.0.1 SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK-probe-1 From: <sip:30@127.0.0.1>;tag=probe-from To: <sip:33@127.0.0.1> Call-ID: probe-1@127.0.0.1 CSeq: 4294967296 OPTIONS Max-Forwards: 70 Content-Length: 0 Observed response: SIP/2.0 404 Not Found ### Possible Solutions The behavior appears related to src/modules/sanity/ sanity.c, where str2valid_uint() compares against 4294967296 and returns success for that exact value. It may be useful to improve the CSeq sanity check so it rejects values outside the RFC 3261 range. ### Additional Information - Kamailio Version - output of kamailio -v kamailio 6.1.3 (x86_64/linux) dc4570 - Operating System: 6.16.8-1kali1 (2025-09-24) x86_64 GNU/Linux -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/4839 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/4839@github.com>