Description
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Published: 2026-11-02
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Kamailio
Kamailio kamailio
Weaknesses CWE-120
CWE-121
CWE-20
Vendors & Products Kamailio
Kamailio kamailio
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Title Stack-based Buffer Overflow in Kamailio ims_qos_npn Module Causing DoS
Weaknesses CWE-119

Mon, 02 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
References

Subscriptions

Kamailio Kamailio
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-02T18:55:18.235Z

Reserved: 2026-10-07T00:00:00.000Z

Link: CVE-2026-106804

cve-icon Vulnrichment

Updated: 2026-11-02T18:54:15.702Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-02T17:17:33.453

Modified: 2026-11-02T19:34:23.993

Link: CVE-2026-106804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T19:15:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-121

    Stack-based Buffer Overflow

  • CWE-20

    Improper Input Validation