EUVD-2026-115345
GHSA-wm7p-xjpr-gf9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SIP service over network
-
DeliverySend crafted SIP REGISTER request
-
ExploitOversized Via host field copied into 46-byte stack buffer
-
ExecutionStack corruption in w_rx_aar_register()
-
ImpactKamailio process terminates (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the target Kamailio instance (v6.1.3 or v6.1.4) has the ims_qos_npn module loaded and its routing configured so that w_rx_aar_register() is invoked on incoming SIP REGISTER requests - i.e., an IMS/VoLTE QoS deployment, not a default or generic SIP proxy setup. Given that prerequisite, no authentication or user interaction is needed (PR:N/UI:N, AC:L): a remote unauthenticated attacker simply sends a REGISTER with a Via host field longer than 46 bytes. The limiting factor is the module/configuration dependency; instances not using ims_qos_npn are not exposed. Impact is confined to availability (crash/DoS); no confidentiality or integrity impact is indicated. |
| Impact | This is a genuine but bounded availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) indicates a remote, low-complexity, unauthenticated trigger with impact limited entirely to availability (C:N/I:N) - consistent with the description's outcome of process termination and denial of service, not code execution. The vuln.today decision label is 'this_week' (not act_now or emergency), reflecting meaningful but non-critical urgency. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; a public PoC reference (a gist) is linked but is not verified as working exploit code. The main mitigating factor the raw CVSS does not capture is that the flaw lives in the optional ims_qos_npn IMS module via w_rx_aar_register(), so only Kamailio deployments that load and route through that module (IMS/VoLTE use cases) are exposed - the CVSS PR:N/AC:L reflects the request-level trigger, not the deployment prerequisite. Net: a real DoS worth patching on affected IMS deployments, but not a confirmed-exploited emergency. |
| Exploit ScenarioDerived | An attacker with network reach to the SIP service sends a crafted REGISTER request whose Via header host field exceeds 46 bytes; when the ims_qos_npn module processes it via w_rx_aar_register(), the oversized host is copied into a fixed stack buffer, corrupting the stack and crashing the Kamailio process, dropping SIP service for all users. No authentication or user interaction is required (PR:N/UI:N, AC:L). A public PoC reference exists (a linked gist); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Unauthenticated remote denial of service in Kamailio 6.1.3 and 6.1.4: a crafted SIP REGISTER request carrying an oversized host field in the Via header is copied into a fixed 46-byte stack buffer by w_rx_aar_register() in the ims_qos_npn module, corrupting the stack and terminating the affected instance. Exposure is not universal - the ims_qos_npn module must be loaded and routing must actually invoke w_rx_aar_register() on incoming REGISTERs, which in practice means IMS/VoLTE QoS deployments rather than a default SIP proxy; for those systems the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) means any remote sender can trigger the crash with no credentials or user interaction. The issue is not in CISA KEV; a public gist linked from the CVE record is a possible PoC reference that is not verified as working exploit code, and priority per vuln.today is remediation this week rather than emergency response.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so affected operators should track https://github.com/kamailio/kamailio/issues/4953 for the upstream fix and upgrade as soon as a release containing it ships. In the interim, reduce exposure by not loading the ims_qos_npn module, or by removing or disabling the routing logic that dispatches SIP REGISTER requests into w_rx_aar_register(), on any instance that does not strictly require IMS QoS handling - the trade-off is loss of Rx/QoS authorisation functionality on that node. Where the module is genuinely required, restrict which peers can reach REGISTER handling to trusted IMS/VoLTE elements through network segmentation or source-address filtering, accepting that legitimate registrations from outside those ranges will be rejected. Both measures are configuration-level compensations for the missing bounds check, not complete fixes, and the underlying flaw is only fully resolved by the upstream patch; a code-level fix would validate the Via host length against the 46-byte buffer before copying.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kamailio is an open-source SIP server used as a proxy/registrar and in IMS cores; the ims_qos_npn module implements IMS QoS signalling over the Rx interface, and its w_rx_aar_register() handler parses REGISTER traffic and extracts the host portion of the SIP Via header. In 6.1.3 and 6.1.4 that host string is written into a 46-byte stack buffer without any length validation, so a host value longer than the buffer produces a classic stack-based overflow and process termination. MITRE assigned CWE-20 (improper input validation), which describes the root-cause class - missing bounds checking on attacker-controlled input - while the resulting memory-safety defect is a stack overflow of the CWE-121 family. The feed's CPE data is unpopulated (cpe:2.3:a:n/a:n/a) and the EUVD affected-version list likewise shows n/a, so product and version identification rests entirely on the advisory text, which pins the flaw to v6.1.3 and v6.1.4. The CVSS vector confirms AV:N/AC:L/PR:N/UI:N with C:N/I:N/A:H, i.e. availability-only impact and no authentication or user interaction prerequisite once the module path is reachable; the sources do not describe any further trigger conditions beyond the Via host copy.
Know when Kamailio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated SIP REGISTER triggers the overflow with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is crash only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP REGISTER request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Executive ViewAI
Kamailio versions 6.1.3 and 6.1.4 contain a high-severity unauthenticated remote denial-of-service vulnerability in the ims_qos_npn module, allowing any network attacker to crash the SIP server by sending a single crafted REGISTER message. Organizations running Kamailio in IMS/VoLTE QoS deployments face service disruption for voice and multimedia users, while default SIP proxy deployments are not exposed unless the module is explicitly loaded and invoked. Security leadership should prioritize patching or mitigating this within the week, as no vendor patch is currently available.
No vendor-released patch identified at time of analysis; interim mitigations include disabling the ims_qos_npn module if not required, restricting SIP REGISTER traffic to trusted peers, and enforcing SIP message size limits to reject oversized Via headers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. Rated critical severity (CVSS 9.8), this
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. Rated criti
Heap-based buffer overflow in Kamailio's CDP (C Diameter Peer) module allows a remote party that can deliver a malformed
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allow
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Rated high s
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Rated high severity (CVSS 7
Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sen
Out-of-bounds memory access in Kamailio SIP server versions before 5.8.8, 6.0.6, and 6.1.1 enables unauthenticated remot
A heap/stack-adjacent buffer overflow in Kamailio's optional sipt module lets remote, unauthenticated attackers crash th
Exploit-DB