EUVD-2026-20617Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet if a successful user authentication without a database backend is followed by additional user identity checks. This vulnerability is fixed in 6.0.5 and 5.8.7.
AnalysisAI
Kamailio versions prior to 6.0.5 and 5.8.7 contain an out-of-bounds read in the auth module that allows remote attackers with high privileges to trigger a denial of service via a specially crafted SIP packet when successful user authentication without a database backend is followed by additional identity checks. The vulnerability requires high privilege level and high attack complexity but can reliably crash the Kamailio process, impacting SIP service availability.
Technical ContextAI
Kamailio is an open-source SIP (Session Initiation Protocol) signaling server used for VoIP call routing and management. The vulnerability exists in the authentication module's handling of user identity validation when operating without a database backend. The root cause is classified as CWE-125 (Out-of-bounds Read), where the auth module fails to properly validate buffer boundaries when processing SIP authentication data during sequential identity verification operations. This occurs specifically in the code path triggered by successful authentication followed by additional user identity checks, suggesting a state management or pointer arithmetic error in the auth module's buffer handling logic.
RemediationAI
Vendor-released patch: Upgrade to Kamailio 6.0.5 or 5.8.7 depending on your installed version. Organizations running Kamailio 6.x should prioritize upgrading to 6.0.5 or later; those on 5.8.x should upgrade to 5.8.7 or later. As an interim mitigation for deployments unable to patch immediately, restrict network access to SIP signaling ports and limit authentication attempts from untrusted sources. Additionally, avoid using the non-database-backend authentication configuration if possible, as this is the specific code path triggering the vulnerability. Detailed patch and upgrade instructions are available in the official GitHub security advisory at https://github.com/kamailio/kamailio/security/advisories/GHSA-6m86-m342-g48m.
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. Rated critical severity (CVSS 9.8), this
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. Rated criti
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allow
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Rated high s
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Rated high severity (CVSS 7
Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sen
Out-of-bounds memory access in Kamailio SIP server versions before 5.8.8, 6.0.6, and 6.1.1 enables unauthenticated remot
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potentia
Null pointer dereference in Kamailio 5.5.0's grammar rule handler (src/core/cfg.y, yyerror_at function) causes denial of
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today