EUVD-2026-20616Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed SIP packet
-
ExploitSend over TCP to Kamailio listener
-
ExecutionTrigger out-of-bounds memory access
-
ImpactCause process crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Kamailio versions prior to 5.8.8, 6.0.6, or 6.1.1 by sending a specially crafted data packet over TCP. Requires Kamailio instance configured with TCP or TLS listeners enabled (default configuration). |
| Impact | CVSS 7.5 reflects high-severity DoS against unauthenticated TCP/TLS endpoints. Out-of-bounds access in core SIP processing creates reliable crash vector for any Kamailio deployment with network-facing TCP listeners. Organizations running affected versions (pre-5.8.8, pre-6.0.6, pre-6.1.1) face service disruption risk; patching urgency is high despite no confidentiality impact. |
| Exploit ScenarioDerived | Attacker sends crafted TCP packet to Kamailio SIP port (unauthenticated, network-accessible). Malformed data triggers out-of-bounds memory access in core packet handler, crashing the process. No authentication required; single packet exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Out-of-bounds memory access in Kamailio SIP server versions before 5.8.8, 6.0.6, and 6.1.1 enables unauthenticated remote attackers to crash server processes via malformed TCP packets. Affects deployments with TCP or TLS listeners enabled. Exploits network-accessible SIP signaling infrastructure without authentication or user interaction, resulting in complete service unavailability. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patches: upgrade to Kamailio 5.8.8, 6.0.6, or 6.1.1 depending on deployment branch. Apply updates immediately for systems with TCP/TLS listeners enabled. Temporary workaround: disable TCP and TLS listeners if operationally feasible, restricting service to UDP transport only until patching completes. Validate listener configuration in kamailio.cfg, removing or commenting TCP/TLS socket directives. Advisory: https://github.com/kamailio/kamailio/security/advisories/GHSA-2wj4-f825-2h2f. Post-upgrade, verify process stability under normal traffic loads and review logs for crash artifacts indicating prior exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 buffer overflow in core TCP packet processing logic triggers out-of-bounds memory access when parsing specially crafted data packets. Vulnerability exists in network-facing components handling TCP/TLS transport layers, bypassing input validation prior to memory operations. Root cause resides in unsafe buffer handling within Kamailio's SIP protocol parser.
Know when Kamailio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
Executive ViewAI
CVE-2026-39863 is a high-severity denial-of-service vulnerability in Kamailio SIP server that allows unauthenticated remote attackers to crash server processes by sending malformed TCP packets, causing complete service disruption to any organization running affected versions with TCP or TLS listeners enabled. Organizations operating VoIP infrastructure or SIP-based communications systems face immediate risk of call service outages without remediation.
Apply vendor patch. If immediate patching is not feasible, implement network-level mitigation by restricting TCP/TLS SIP listener access to trusted networks only via firewall rules, though this may impact legitimate external calling scenarios and is not a substitute for patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. Rated critical severity (CVSS 9.8), this
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. Rated criti
Heap-based buffer overflow in Kamailio's CDP (C Diameter Peer) module allows a remote party that can deliver a malformed
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allow
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Rated high s
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Rated high severity (CVSS 7
Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sen
A heap/stack-adjacent buffer overflow in Kamailio's optional sipt module lets remote, unauthenticated attackers crash th
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potentia
Exploit-DB