CVE-2026-52023 in Kamailio
Summary
by MITRE • 09/01/2026
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in Kamailio versions 6.1.1 and earlier represents a critical denial of service risk within the Session Initiation Protocol (SIP) infrastructure, specifically targeting the ims_registrar_pcscf module. This software component is essential for managing registration and proxy call session control functions in IP Multimedia Subsystem architectures. The flaw resides deep within the security agreement parsing logic located in the source file sec_agree.c, particularly affecting the pcscf_save_pending function path. When a remote attacker interacts with this specific code path by sending malformed or maliciously crafted SIP messages, they can trigger an exception that leads to process termination or severe resource exhaustion, effectively halting service availability for legitimate users relying on the registrar and proxy services.
From a technical perspective, the root cause lies in insufficient validation during the parsing of security agreements within the pcscf_save_pending routine. The parse_sec_agree function is responsible for interpreting authentication and integrity protection parameters exchanged between network entities. If an attacker crafts a SIP request containing unexpected data structures or invalid states that violate expected protocol constraints, the application fails to handle these anomalies gracefully. Instead of rejecting the malformed input with a standard error response, the software encounters an unrecoverable state, leading to a crash. This behavior indicates a lack of robust boundary checking and exception handling mechanisms when processing external inputs in this specific module, allowing for remote exploitation without requiring any prior authentication credentials.
The operational impact of this vulnerability is significant for organizations deploying Kamailio as their core SIP proxy or registrar. A successful exploit allows an unauthenticated attacker to disrupt critical communication services by causing the kamailio process to crash repeatedly or indefinitely. This denial of service condition prevents legitimate users from registering with the network, making calls, or accessing multimedia services. In high-availability environments where Kamailio handles thousands of concurrent sessions, such instability can lead to widespread outages, impacting business continuity and customer trust. The ability to trigger this state remotely makes it particularly dangerous as no social engineering or local access is required for exploitation.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately verify the integrity and format of incoming security agreement data before processing it. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior corresponds to T1499 Endpoint Denial of Service or potentially T1529 System Shutdown/Reboot if the crash leads to service restart loops that exhaust system resources like CPU and memory over time. The attack vector is classified as Network-based (Attack Vector: Network) with Low Complexity, given that it requires only network access and no user interaction beyond sending a crafted packet.
To mitigate this risk, organizations running Kamailio versions prior to 6.1.2 must upgrade immediately to the patched version where these input validation checks have been strengthened in sec_agree.c. Until an upgrade is feasible, deploying a Web Application Firewall or SIP-specific intrusion prevention system can help filter out malformed packets that exhibit patterns associated with this exploit before they reach the Kamailio process. Additionally, implementing rate limiting on registration and proxy requests may reduce the blast radius of such attacks by slowing down the frequency at which malicious inputs are processed, thereby providing time for monitoring systems to detect anomalous traffic patterns indicative of a denial-of-service attempt. Regular security audits focusing on SIP protocol handling modules should also be conducted to identify similar input validation gaps in other parts of the stack.