Home

Description

Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.

PUBLISHED Reserved 2026-04-07 | Published 2026-04-08 | Updated 2026-04-09 | Assigner GitHub_M




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Product status

< 5.8.8
affected

>= 6.0.0, < 6.0.6
affected

>= 6.1.0, < 6.1.1
affected

References

github.com/...mailio/security/advisories/GHSA-2wj4-f825-2h2f

cve.org (CVE-2026-39863)

nvd.nist.gov (CVE-2026-39863)

Download JSON