Live › vulnerability › CVE-2026-106803
Kamailio's ims_registrar_pcscf module copies an attacker-supplied port from a NOTIFY message's alias parameter into a fixed 5-byte stack buffer without a length check. An unauthenticated remote attacker can corrupt the stack and terminate the P-CSCF process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 17:24 UTC. All times on this page are UTC.
Deployments of Kamailio 6.1.3 or 6.1.4 that run the ims_registrar_pcscf module as a P-CSCF and accept reginfo+xml NOTIFY messages from the network are exposed. Systems on other Kamailio versions or without this module are not described as affected.
No product ranges from the sources yet.
kamailio -v; versions 6.1.3 and 6.1.4 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-106803")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.