Executive brief
Kamailio is a widely-used SIP server that handles voice and messaging registration in telecommunications networks. A vulnerability in its IMS P-CSCF (Proxy Call Session Control Function) component causes the server to crash when processing malformed or rapidly-sequenced SIP REGISTER messages during device registration. An attacker can exploit this to take down the registration service, preventing legitimate devices from connecting to the network.
Technical details
The vulnerability is a use-after-free / double-free memory corruption issue in the ims_usrloc_pcscf module's REGISTER reply handling path, specifically during IPSec negotiation in the free_security() function. The defect occurs when overlapping or high-rate registration transactions trigger abnormal state handling in the IMS contact management code. The attack is network-accessible and requires no authentication; an attacker can send specially crafted or high-frequency SIP REGISTER messages to induce a segmentation fault (SIGSEGV) in the P-CSCF worker process. The root cause is a missing check to prevent double memory free when certain transaction states coincide. A fix has been released via commit 91c5ca7, which adds checks in the free_security() method to prevent the double-free condition.
Affected products
- Kamailio Kamailio 6.1.1 and before
Timeline
- 2026-09-01: disclosed
- other: Double-free bug fixed in commit 91c5ca7