Executive brief
Kamailio, an open-source SIP server commonly used in telecommunications infrastructure, contains a vulnerability in its AVP (Attribute-Value Pair) handler component that can allow remote attackers to read memory outside intended boundaries. An attacker can exploit this flaw to access sensitive data or cause a service crash without authentication, potentially disrupting VoIP call routing and session management.
Technical details
The vulnerability is an out-of-bounds read in the get_4bytes() function within the ims_registrar_scscf module's cxdx_avp.c component, which handles AVP (Attribute-Value Pair) parsing in the IMS (IP Multimedia Subsystem) registrar. The root cause is insufficient length validation before reading 4-byte values from network packets, allowing attackers to read memory beyond allocated buffers. The vulnerability is network-reachable and requires no authentication; a remote attacker can craft malicious SIP messages to trigger the out-of-bounds read. Exploitation results in information disclosure and potential denial of service. Patch abb5d60af6eefbd367bf6588c5589566b090e272 adds length checks before calling get_4bytes() and has been merged into the main branch.
Affected products
- Kamailio Kamailio 5.5.0 and 6.0.7 and prior
Timeline
- 2026-08-31: disclosed
- 2026-07-16: patched: Patch merged via PR #4823 on July 16, 2026