CVE-2026-106803 in Kamailio
Summary
by MITRE • 11/02/2026
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Kamailio versions 6.1.3 and 6.1.4 represents a critical security flaw within the ims_registrar_pcscf module, specifically affecting the handling of Session Initiation Protocol signaling messages. This stack-based buffer overflow occurs during the processing of application/reginfo+xml NOTIFY messages, which are standard in IP Multimedia Subsystem architectures for managing user registration states and proxy contact information. The root cause lies in the process_contact function, where an attacker-controlled port value extracted from the alias parameter is copied into a fixed-size five-byte stack buffer without any prior validation of its length or format. This lack of bounds checking allows data exceeding the allocated memory space to overwrite adjacent stack memory, leading to immediate corruption of the execution context and subsequent termination of the Proxy-Call Session Control Function process.
From an operational perspective, this vulnerability enables a remote denial-of-service attack against VoIP infrastructure components that rely on Kamailio for session control. Because the flaw can be triggered by an unauthenticated attacker sending a single crafted message, it poses a significant risk to service availability in production environments. The termination of the P-CSCF process disrupts ongoing voice and video sessions, prevents new registrations from being processed, and may cause cascading failures if high-availability configurations are not properly isolated or monitored. This aligns with CWE-121, which classifies stack-based buffer overflows as a category of memory corruption vulnerabilities that arise when data is written beyond the boundaries of a fixed-length stack buffer, potentially allowing for arbitrary code execution in more severe scenarios where control flow hijacking is possible, although currently observed primarily as a crash vector.
The attack surface associated with this vulnerability falls under MITRE ATT&CK technique T1498, Network Denial of Service, specifically within the context of VoIP infrastructure exploitation. Attackers can leverage standard SIP NOTIFY messages to trigger the flaw without needing valid credentials or prior interaction with the system, making it particularly dangerous in open deployment scenarios where edge servers are directly exposed to untrusted networks. The simplicity of the exploit mechanism underscores the importance of rigorous input validation at all entry points for protocol parsers, especially when handling parameters that influence memory allocation and data copying operations within critical network services.
To mitigate this vulnerability, organizations running Kamailio versions 6.1.3 or 6.1.4 must upgrade to a patched version where the process_contact function has been updated to enforce strict length checks on incoming port values before they are copied into stack buffers. Additionally, implementing network-level access control lists to restrict SIP signaling traffic to trusted sources can provide an additional layer of defense against unauthenticated exploitation attempts. Security teams should also monitor for abnormal termination patterns in P-CSCF processes and ensure that logging mechanisms capture detailed information about malformed NOTIFY messages to facilitate rapid detection and response during the transition period before patching is completed.