UBUNTU-CVE-2026-106804: Buffer Overflow
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsqosnpn module. The wrxaarregister() function copies the attacker-controlled host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP REGISTER request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Kamailio instances running version 6.1.3 or 6.1.4 with the ims_qos_npn module affected by this code path are exposed. An attacker can target the service remotely without authentication by sending a crafted SIP REGISTER request.
What is required to trigger the issue?
The attacker needs network access to the Kamailio SIP service and must send a REGISTER request containing an overly long attacker-controlled host value in the Via header. No privileges or user interaction are required.
What is the expected impact of a successful attack?
Successful exploitation corrupts stack memory and can terminate the Kamailio instance, causing a denial of service. The provided information does not establish confidentiality or integrity impact.