CVE-2026-106804
UnknownSummary
A stack-based buffer overflow exists in the ims_qos_npn module of Kamailio v6.1.3 and v6.1.4. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Risk Assessment
An attacker can remotely and without authentication crash the Kamailio server, disrupting VoIP/SIP services in the organization. Repeated attacks can cause sustained unavailability of communication services.
Recommendation
Update Kamailio to a version containing the fix, or disable the ims_qos_npn module if it is not used. Consider restricting access to the SIP service from untrusted networks.
Other vulnerabilities in Kamailio
See all- CVE-2026-106803Unknown
A stack-based buffer overflow exists in the ims_registrar_pcscf module of Kamailio v6.1.3 and v6.1.4. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.
- CVE-2015-1590High
The kamcmd administrative utility and default configuration in kamailio before version 4.3.0 use the /tmp/kamailio_ctl directory.
- CVE-2015-1591High
Versions of kamailio before 4.2.0-2 have a vulnerability that allows local users to gain elevated privileges.
- CVE-2013-7426Critical
CVE-2013-7426 identifies an insecure handling of temporary files in kamailio 4.0.1, specifically concerning the /tmp/kamailio_fifo file. This may lead to unauthorized access to data.
- CVE-2026-108822Medium
A vulnerability was detected in Kamailio up to versions 6.0.7/6.1.3 in the isup_get_calling_party function of the file src/modules/sipt/ss7_parser.c in the sipt module. Manipulation of the length argument results in buffer overflow. The attack may be performed remotely.
- CVE-2026-93962High
A weakness in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1 affects the shm_malloc function in src/modules/cdp/receiver.c of the CDP Diameter Receiver component. Manipulation leads to a heap-based buffer overflow. The attack can be remote, and the exploit is public. Upgrading to 6.0.8 resolves the issue.
- CVE-2026-52023High
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree().
- CVE-2026-52022High
A vulnerability in Kamailio version 6.1.1 and earlier allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components.
- CVE-2026-82608High
A vulnerability in Kamailio up to 5.5.0/6.0.7 in the get_4bytes function of the cxdx_avp.c file in the AVP Handler component leads to an out-of-bounds read. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-39864Medium
Kamailio before versions 6.0.5 and 5.8.7 contains an out-of-bounds read vulnerability in the auth module. A specially crafted SIP packet can cause a process crash (DoS) after successful user authentication without a database backend.
Original NVD description (English source)
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS