{"id":"CVE-2026-106804","kind":"vulnerability","aliases":["CVE-2026-106804"],"related":[],"title":"Kamailio: stack buffer overflow in ims_qos_npn lets crafted SIP REGISTER crash server","description":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.","summary":"Kamailio versions 6.1.3 and 6.1.4 copy the host field from a SIP Via header into a fixed 46-byte stack buffer in the ims_qos_npn module without a length check. An unauthenticated remote attacker can send a crafted SIP REGISTER request to corrupt the stack and crash the Kamailio process, causing denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kamailio","fixed":["6.1.5"],"affected":"6.1.3, 6.1.4 (ims_qos_npn module)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ims","kamailio","runtime","self-hosted","sip","voip"],"not_affected_if":["fixed-6.1.5","ims-qos-npn-not-loaded","other-kamailio-versions"],"how_to_check":"1. Run `kamailio -v`: 6.1.3 and 6.1.4 are reported affected; 6.1.5 has the fix. Distro packages may backport, so check the package changelog for 'ims_qos_npn: check Via host length'.\n2. Grep your config for `loadmodule \"ims_qos_npn\"` and for `Rx_AAR_Register`. The reporter says the vulnerable code runs on each REGISTER when Rx_AAR_Register() is called; if the module is not loaded, this issue does not apply.\n3. Also check if you run an older 6.0.x/5.x build that includes ims_qos_npn (added in PR #3921, 2024): the reporter tested only 6.1.3 and checked 6.1.4 and master by source reading; earlier versions are unconfirmed.","fix":"Upgrade Kamailio to 6.1.5 (released 2026-10-15), which includes the ims_qos_npn Via host length check (commit 41326b65, backport of master fb93ca8c, fixes issue #4953). Building from master after 2026-09-28 also has it.","status":"open","published_at":"2026-11-02T17:17:33+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:25+00:00","updated_at":"2026-11-02T17:27:49+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-02T17:26:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Kamailio: stack buffer overflow in ims_qos_npn lets crafted SIP REGISTER crash server","impact":"low","summary":"Kamailio versions 6.1.3 and 6.1.4 copy the host field from a SIP Via header into a fixed 46-byte stack buffer in the ims_qos_npn module without a length check. An unauthenticated remote attacker can send a crafted SIP REGISTER request to corrupt the stack and crash the Kamailio process, causing denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["kamailio","voip","sip","ims"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote crash of the Kamailio instance, causing denial of service","analyst_note":"Find the upstream Kamailio advisory or fixed release for 6.1.3/6.1.4 and confirm whether ims_qos_npn is loaded by default; source is https://nvd.nist.gov/vuln/detail/CVE-2026-106804.","how_to_check":"- Run `kamailio -v` to read the installed version and confirm whether it is `6.1.3` or `6.1.4`.\n- Check whether the ims_qos_npn module is loaded in the Kamailio configuration.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-kamailio-versions","ims-qos-npn-not-loaded"],"who_is_affected":"Kamailio 6.1.3 and 6.1.4 are affected according to the NVD entry. The flaw sits in the ims_qos_npn module, which is used in IMS deployments, so teams running other Kamailio releases or without that module are likely not exposed; the sources do not confirm the module's default load state. unknown for anything beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4196,"output_tokens":678,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the upstream Kamailio advisory or fixed release for 6.1.3/6.1.4 and confirm whether ims_qos_npn is loaded by default; source is https://nvd.nist.gov/vuln/detail/CVE-2026-106804.","search":"'-106804':17A,20A '-2026':16A,19A '46':47B,124C '6.1.3':32B '6.1.4':34B 'aar':106C 'affect':153C 'attack':64B,112C,135C 'attacker-control':111C 'base':88C 'buffer':3A,50B,89C,127C 'byte':48B,125C 'caus':81B,146C 'check':60B 'control':113C 'copi':35B,109C 'corrupt':73B,148C 'craft':10A,68B,142C 'crash':13A,77B 'cve':15A,18A 'denial':82B,158C 'exist':91C 'field':38B,115C 'fix':46B,123C 'function':108C 'header':43B,120C 'host':27B,37B,114C 'im':6A,22B,53B,99C 'instanc':155C 'kamailio':1A,21A,23B,30B,79B,93C,154C 'length':59B,131C 'let':9A 'modul':56B,102C 'npn':8A,55B,101C 'overflow':4A,90C 'process':80B 'qos':7A,54B,100C 'regist':12A,70B,107C,144C 'remot':63B,134C 'request':71B,145C 'result':156C 'runtim':24B 'rx':105C 'self':26B 'self-host':25B 'send':66B 'server':14A 'servic':84B,160C 'sip':11A,28B,41B,69B,118C,143C 'stack':2A,49B,75B,87C,126C,147C 'stack-bas':86C 'termin':150C 'trigger':137C 'unauthent':62B,133C 'v6.1.3':94C 'v6.1.4':96C 'valid':129C 'version':31B 'via':42B,119C 'voip':29B 'vulner':139C 'w':104C 'without':57B,128C","nicknames":[],"mitigations":[],"who_affected":"Kamailio 6.1.3 and 6.1.4 with the optional ims_qos_npn module loaded and Rx_AAR_Register() used, typically a P-CSCF (also I-CSCF/S-CSCF/AS) in an IMS/VoLTE/VoWiFi core. An unauthenticated SIP REGISTER with an oversized Via host overflows a 46-byte stack buffer; the reporter's described result is a crash (denial of service). Kamailio plain SIP proxies without ims_qos_npn, and the older ims_qos module (already fixed in April 2026), can skip it. The module is IMS-specific and needs an explicit loadmodule; the module docs do not describe it as loaded by default. Versions before 6.1.3 are unconfirmed.","tier":"B","verified":{"fix":{"at":"2026-11-02T17:27:49Z","by":"analyst","doc":"https://kamailio.org/mailman3/hyperkitty/list/sr-dev@lists.kamailio.org/message/IYWLBMEAABC3JOBR2DUNUBL2LVFLYPCF/attachment/2/attachment.html","run_id":1406}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["kamailio"],"ptokens":["kamailio"],"labels":["high","ims","kamailio","runtime","selfhosted","sip","voip"],"first_public_at":"2026-11-02T17:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106804","severity":null,"published_at":"2026-11-02T17:17:33+00:00","modified_at":"2026-11-02T17:17:33+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106804:1406","url":null,"severity":null,"published_at":"2026-11-02T17:27:49+00:00","modified_at":"2026-11-02T17:27:49+00:00","first_seen_at":"2026-11-02T17:27:49+00:00","fetched_at":"2026-11-02T17:27:49+00:00","note":"Fixed upstream: master fb93ca8c (2026-09-28), 6.1 branch 41326b65 (2026-10-13), shipped in 6.1.5 ChangeLog. Reporter issue #4953 gives details; no exploitation or public PoC code seen. Default-load state: module is optional, not shown as default; not verified against default cfg. Older versions unconfirmed."}],"documents":[{"id":53089,"url":"https://www.kamailio.org/pub/kamailio/6.1.5/ChangeLog","title":"Kamailio 6.1.5 ChangeLog (includes ims_qos_npn Via host length check)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":53090,"url":"https://www.kamailio.org/w/2026/10/kamailio-v6-1-5-released/","title":"Kamailio v6.1.5 Released","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":53091,"url":"https://kamailio.org/mailman3/hyperkitty/list/sr-dev@lists.kamailio.org/thread/GZUT2MHPIOGBK4XMBLSCHCVS77FK7MMW/","title":"git:master:fb93ca8c: ims_qos_npn: check Via host length before copying (Fixes #4953)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53092,"url":"https://kamailio.org/mailman3/hyperkitty/list/sr-dev@lists.kamailio.org/message/IYWLBMEAABC3JOBR2DUNUBL2LVFLYPCF/attachment/2/attachment.html","title":"Issue #4953: ims_qos_npn missing Via host length check in w_rx_aar_register()","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}