CVE-2026-106804 in Kamailio
Summary
by MITRE • 11/02/2026
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified vulnerability resides within the ims_qos_npn module of Kamailio versions 6.1.3 and 6.1.4, specifically affecting the w_rx_aar_register function. This component is responsible for handling Authorization-Attribute-Request messages in IP Multimedia Subsystem environments, which are critical for quality-of-service policy enforcement. The core technical flaw is a classic stack-based buffer overflow caused by an improper boundary check during data processing. When the system processes incoming SIP traffic, it extracts specific fields from the packet headers to populate internal structures. In this instance, the function retrieves the host field from the Via header and attempts to copy its contents into a fixed-size local variable on the call stack that is only 46 bytes in length. The implementation fails to validate the length of the incoming data against the destination buffer size before performing the memory copy operation. This lack of input validation allows an attacker who controls the content of the Via header to supply a string significantly longer than forty-six characters, thereby overwriting adjacent memory locations on the stack.
From an operational perspective, this vulnerability presents a severe denial-of-service risk for organizations relying on Kamailio as their SIP proxy or registrar. Because the overflow occurs within a function that is triggered by standard registration procedures, it can be exploited remotely without requiring any form of authentication. An unauthenticated attacker can craft a malicious SIP REGISTER request containing an oversized host field in the Via header and send it to the vulnerable server. Upon processing this malformed packet, the application will experience stack corruption due to the buffer overflow. This memory violation typically leads to immediate process termination or crash of the Kamailio instance. The resulting service disruption affects all users attempting to register with or communicate through the compromised proxy, effectively halting voice and video services that depend on the infrastructure.
This vulnerability is categorized under CWE-121, which describes stack-based buffer overflow conditions where a program writes data beyond the boundaries of a fixed-size stack buffer. The exploitation technique aligns with MITRE ATT&CK tactic T1498, specifically Network Denial of Service, as the primary objective and outcome are to disrupt service availability rather than gain unauthorized access or execute arbitrary code in this specific context. While some buffer overflows can lead to remote code execution through sophisticated stack smashing techniques, the immediate impact described here is process termination. However, the underlying memory corruption remains a critical security weakness that could potentially be leveraged for more severe attacks if additional exploitation vectors are present in adjacent memory structures or if the environment allows for further manipulation of the corrupted state.
Mitigation strategies should focus on both immediate remediation and long-term defensive coding practices. The most effective solution is to apply vendor-provided patches immediately, updating Kamailio to a version where this issue has been resolved by implementing proper length checks before copying data into fixed buffers. Administrators who cannot patch immediately may consider deploying network-level access control lists or firewall rules to restrict SIP traffic sources to trusted IP addresses only, thereby limiting the attack surface for unauthenticated actors. Additionally, enabling deep packet inspection on perimeter firewalls can help detect and block malformed SIP packets with oversized headers before they reach the application layer. Future development efforts should prioritize input validation routines that explicitly check buffer sizes against incoming data lengths, ensuring that no external input is copied into fixed-size stack variables without rigorous boundary verification to prevent similar overflow conditions in other modules.