CVE-2026-106804: Input Validation
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsqosnpn module. The wrxaarregister() function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP REGISTER request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kamailio versions 6.1.3 and 6.1.4 are affected when the ims_qos_npn module processes SIP REGISTER requests through the vulnerable w_rx_aar_register() function.
What does an attacker need to exploit it?
An attacker only needs network access to send a crafted SIP REGISTER request. No authentication or user interaction is required.
What is the practical impact of successful exploitation?
A maliciously long host field in the SIP Via header can corrupt the stack and terminate the Kamailio instance, causing denial of service. The provided information does not establish confidentiality or integrity impact.
How can I determine whether an instance may be affected?
Check whether the deployment runs Kamailio 6.1.3 or 6.1.4 and uses the ims_qos_npn module in a path that invokes w_rx_aar_register() for SIP REGISTER processing.