EUVD-2026-69415
GHSA-6g2r-mqww-4r35
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable SIP port, no credentials required, crash is immediate on receipt of malformed REGISTER; pure availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components
AnalysisAI
Remote unauthenticated denial of service in Kamailio 6.1.1 and earlier crashes the P-CSCF SIP proxy by triggering a NULL pointer dereference in the free_security() function when processing IMS registration cleanup of partially initialized IPsec security structures. The upstream commit (91c5ca7) confirms the root cause: shm_free() was called unconditionally on pointer fields that may be NULL in the ims_usrloc_pcscf module, crashing the Kamailio process and dropping all active registrations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Kamailio instance be explicitly configured with the `ims_usrloc_pcscf` module loaded and actively handling IMS P-CSCF registrations - this is not enabled in a default Kamailio deployment and applies only to IMS core infrastructure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the attack as network-reachable, unauthenticated, and requiring no user interaction against Kamailio instances running the IMS P-CSCF module. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream commit 91c5ca751799db4f25a28a495350cc97f7c2f390 from the Kamailio GitHub repository (https://github.com/kamailio/kamailio/commit/91c5ca751799db4f25a28a495350cc97f7c2f390), which adds null guards to every `shm_free()` call in `free_security()` within `ims_usrloc_pcscf/pcontact.c`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Kamailio deployments and identify systems running version 6.1.1 or earlier; check for recent unexpected process crashes in P-CSCF logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today