Quick answers
- Is CVE-2026-52023 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52023 being exploited in the wild.
- How severe is CVE-2026-52023?
- High severity, with a CVSS score of 7.5, published 1 September 2026.
- Which products and versions are affected?
- Kamailio 6.1.1 and before.
- Is there a fix for CVE-2026-52023?
- A patch was published on 2026-09-01: Fix available in commit 722c06b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52023 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-52023?
- Check whether you run Kamailio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a double-free memory corruption bug in the ims_registrar_pcscf module, specifically in the sec_agree.c:parse_sec_agree() function that handles security-agreement parsing. The flaw occurs when concurrent REGISTER and de-REGISTER requests for the same contact are processed simultaneously; one execution path continues handling security-agreement state while another updates or expires the pending registration, leading to inconsistent internal state and a double memory free. The attack requires network access to the SIP server and no authentication is needed—an unauthenticated attacker can send overlapping registration requests with varying expiry times to trigger a crash. The issue has been fixed in the Kamailio repository (commit 722c06b) by preventing the double free condition.
Affected products
- Kamailio Kamailio 6.1.1 and before
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fix available in commit 722c06b