Quick answers
- Is CVE-2026-106803 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-106803 being exploited in the wild.
- How severe is CVE-2026-106803?
- Informational severity, published 2 November 2026.
- Which products and versions are affected?
- Kamailio v6.1.3, v6.1.4.
- Is there a fix for CVE-2026-106803?
- Yes: fixed in Fixed in commit 2126143 (enlarges buffer to 6 bytes and validates port length to maximum 5 digits). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-106803 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-106803?
- Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Fixed in commit 2126143 (enlarges buffer to 6 bytes and validates port length to maximum 5 digits)
Technical details
The ims_registrar_pcscf module's process_contact() function copies an attacker-controlled port value from a SIP NAT alias parameter into a 5-byte (later 6-byte) stack buffer without proper length validation. An unauthenticated remote attacker can send a crafted application/reginfo+xml NOTIFY message with an oversized port value to overflow the buffer, corrupt the stack, and terminate the P-CSCF process.
Affected products
- Kamailio Kamailio v6.1.3, v6.1.4
Timeline
- 2026-11-02: disclosed: CVE-2026-106803 published