EUVD-2026-69414
GHSA-3vmm-j973-v9x5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable SIP port, single malformed packet sufficient (AC:L), no authentication required at P-CSCF REGISTER stage, process crash is complete availability loss with no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
7DescriptionCVE.org
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()
AnalysisAI
Denial of service in Kamailio v6.1.1 and earlier allows an unauthenticated remote attacker to crash the SIP proxy by sending a crafted SIP REGISTER message with a malformed Security-Agreement header. The vulnerability resides in the ims_registrar_pcscf module's parse_sec_agree() function in sec_agree.c, which unconditionally calls shm_free() on IPSec parameter string pointers that may be NULL or uninitialized when header parsing fails mid-way, corrupting the Kamailio shared memory pool and crashing the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Kamailio to be deployed with the `ims_registrar_pcscf` module loaded - this module is specific to 3GPP IMS P-CSCF roles and is not part of standard or default Kamailio builds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 (High) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures the exposure for deployments running the affected module: a single malformed SIP packet over the network with no authentication is sufficient to crash the server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream fix commit 722c06b3efc53ccb369ce812c685c7d069508187 from https://github.com/kamailio/kamailio/commit/722c06b3efc53ccb369ce812c685c7d069508187 to the `src/modules/ims_registrar_pcscf/sec_agree.c` source file and rebuild; no tagged release version incorporating this fix has been independently confirmed at time of analysis, so monitor https://github.com/kamailio/kamailio/releases for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Kamailio instances running version 6.1.1 or earlier, then assess network exposure and document business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c
Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. Rated critical severity (CVSS 9.8), this
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. Rated criti
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allow
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. Rated high s
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Rated high severity (CVSS 7
Out-of-bounds memory access in Kamailio SIP server versions before 5.8.8, 6.0.6, and 6.1.1 enables unauthenticated remot
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potentia
Null pointer dereference in Kamailio 5.5.0's grammar rule handler (src/core/cfg.y, yyerror_at function) causes denial of
Kamailio 5.5.0 suffers a null pointer dereference in the rve_is_constant function (src/core/rvalue.c) triggered by manip
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today