Live › vulnerability › CVE-2026-106804
Kamailio versions 6.1.3 and 6.1.4 copy the host field from a SIP Via header into a fixed 46-byte stack buffer in the ims_qos_npn module without a length check. An unauthenticated remote attacker can send a crafted SIP REGISTER request to corrupt the stack and crash the Kamailio process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 17:24 UTC. All times on this page are UTC.
Kamailio 6.1.3 and 6.1.4 with the optional ims_qos_npn module loaded and Rx_AAR_Register() used, typically a P-CSCF (also I-CSCF/S-CSCF/AS) in an IMS/VoLTE/VoWiFi core. An unauthenticated SIP REGISTER with an oversized Via host overflows a 46-byte stack buffer; the reporter's described result is a crash (denial of service). Kamailio plain SIP proxies without ims_qos_npn, and the older ims_qos module (already fixed in April 2026), can skip it. The module is IMS-specific and needs an explicit loadmodule; the module docs do not describe it as loaded by default. Versions before 6.1.3 are unconfirmed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| kamailio | vendor | 6.1.3, 6.1.4 (ims_qos_npn module) | 6.1.5 |
kamailio -v: 6.1.3 and 6.1.4 are reported affected; 6.1.5 has the fix. Distro packages may backport, so check the package changelog for 'ims_qos_npn: check Via host length'.loadmodule "ims_qos_npn" and for . The reporter says the vulnerable code runs on each REGISTER when Rx_AAR_Register() is called; if the module is not loaded, this issue does not apply.Rx_AAR_Register6.1.5 (released 2026-10-15), which includes the ims_qos_npn Via host length check (commit 41326b65, backport of master fb93ca8c, fixes issue #4953)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP REGISTER request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-106804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.