CVE-2026-108822: Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isupgetcallingparty of the file src/modules/sipt/ss7parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kamailioto a version that resolves this vulnerability.Fixed in 6.0.8Patch 3667bebf8d0bea07ed16218fd921d07db87aeb21 - Upgrade
Upgrade
Kamailioto a version that resolves this vulnerability.Fixed in 6.1.4Patch 3667bebf8d0bea07ed16218fd921d07db87aeb21
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kamailio deployments using the sipt module are affected if they run versions up to 6.0.7 or up to 6.1.3. The vulnerable code is in the module's SS7 parser.
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied severity vector identifies network attack access, low attack complexity, no required privileges, and no user interaction.
What versions remediate the vulnerability?
Upgrade to Kamailio 6.0.8 or 6.1.4. The associated patch is 3667bebf8d0bea07ed16218fd921d07db87aeb21.