EUVD-2026-20616Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
AnalysisAI
Out-of-bounds memory access in Kamailio SIP server versions before 5.8.8, 6.0.6, and 6.1.1 enables unauthenticated remote attackers to crash server processes via malformed TCP packets. Affects deployments with TCP or TLS listeners enabled. Exploits network-accessible SIP signaling infrastructure without authentication or user interaction, resulting in complete service unavailability. No public exploit identified at time of analysis.
Technical ContextAI
CWE-119 buffer overflow in core TCP packet processing logic triggers out-of-bounds memory access when parsing specially crafted data packets. Vulnerability exists in network-facing components handling TCP/TLS transport layers, bypassing input validation prior to memory operations. Root cause resides in unsafe buffer handling within Kamailio's SIP protocol parser.
RemediationAI
Vendor-released patches: upgrade to Kamailio 5.8.8, 6.0.6, or 6.1.1 depending on deployment branch. Apply updates immediately for systems with TCP/TLS listeners enabled. Temporary workaround: disable TCP and TLS listeners if operationally feasible, restricting service to UDP transport only until patching completes. Validate listener configuration in kamailio.cfg, removing or commenting TCP/TLS socket directives. Advisory: https://github.com/kamailio/kamailio/security/advisories/GHSA-2wj4-f825-2h2f. Post-upgrade, verify process stability under normal traffic loads and review logs for crash artifacts indicating prior exploitation attempts.
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. Rated critical severity (CVSS 9.8), this
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. Rated criti
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allow
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Rated high s
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Rated high severity (CVSS 7
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potentia
Null pointer dereference in Kamailio 5.5.0's grammar rule handler (src/core/cfg.y, yyerror_at function) causes denial of
Kamailio 5.5.0 suffers a null pointer dereference in the rve_is_constant function (src/core/rvalue.c) triggered by manip
Use-after-free vulnerability in Kamailio 5.5.0 configuration file parser allows local authenticated attackers to cause d
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today