Executive brief
Kamailio is an open-source SIP server used for managing internet-based voice and video communications. A vulnerability in its authentication module allows an attacker to crash the server by sending a specially crafted communication packet. This could lead to a service outage, though it requires the attacker to already have valid user credentials and only affects specific configurations that do not use a database for authentication.
Technical details
An out-of-bounds read vulnerability exists in the auth.so module of Kamailio. The flaw is triggered when a successful RFC2617 user authentication occurs without a database backend, followed by additional user identity checks. A remote attacker with high privileges (authenticated user) can exploit this by sending a specially crafted SIP packet, leading to a process crash and denial of service. The vulnerability is rooted in how the module handles memory during identity verification in non-database configurations. It is fixed in versions 5.8.7 and 6.0.5.
Affected products
- Kamailio Kamailio < 5.8.7, >= 6.0.0 < 6.0.5
Timeline
- 2026-04-07: advisory: GitHub advisory published by vendor
- 2026-04-08: disclosed: CVE published to NVD