Threats affecting pkg:github/kamailio/kamailio

Kamailio versions 6.1.3 and 6.1.4 contain a stack-based buffer overflow vulnerability in the ims_registrar_pcscf module. The flaw occurs when processing a crafted application/reginfo+xml NOTIFY message, where an attacker-controlled port value is copied into a fixed 5-byte stack buffer without length validation. This can lead to stack corruption and termination of the P-CSCF process, causing a denial of service. The vulnerability can be triggered by an unauthenticated remote attacker.

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

CVE-2026-108822 is a buffer overflow vulnerability in Kamailio versions 6.0.0 through 6.0.7 and 6.1.0 through 6.1.3. It occurs in the isup_get_calling_party function within the sipt module's ss7_parser.c file due to improper handling of an argument length. This vulnerability can be exploited remotely. Upgrading to Kamailio versions 6.0.8 or 6.1.4 resolves the issue.

CVE-2026-93962 is a heap-based buffer overflow vulnerability in Kamailio affecting versions 5.8.0 through 5.8.8, 6.0.0 through 6.0.7, 6.1.0 through 6.1.4, and 6.2.0-dev1. The flaw exists in the shm_malloc function within the CDP Diameter Receiver module. This vulnerability can be exploited remotely without authentication. A public exploit is available. Upgrading to Kamailio version 6.0.8 or later resolves the issue.