CVE-2026-52023

Modified Modified - Updated After Analysis

Kamailio DoS via IMS Registrar PCSCF Module

Publication date: 2026-09-01

Last updated on: 2026-10-19

Assigner: MITRE

Description

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-09-01

EPSS Evaluated

2026-11-07

NVD

CVE-2026-52023

EUVD

EUVD-2026-69414

Affected Vendors & Products

Vendor	Product	Version / Range
kamailio	kamailio	to 6.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in Kamailio versions 6.1.1 and earlier. It occurs in the ims_registrar_pcscf module when handling concurrent REGISTER and de-REGISTER requests for the same user equipment. A race condition during security-agreement parsing leads to inconsistent internal state and crashes the system with a segmentation fault.

Detection Guidance

Monitor Kamailio logs for warnings from sec_agree.c, such as 'qm_free(): WARNING: free(0) called from ims_registrar_pcscf: sec_agree.c: parse_sec_agree(...)'. Check for crashes with signal 11 (segmentation fault) in core dumps during high-rate concurrent REGISTER and de-REGISTER requests for the same UE.

Impact Analysis

If exploited, this vulnerability can cause Kamailio servers to crash repeatedly, disrupting VoIP services and communication systems. It specifically affects the P-CSCF component handling registration traffic, potentially leading to service outages during high concurrent registration attempts.

Compliance Impact

This vulnerability primarily causes denial of service through crashes in Kamailio's P-CSCF module due to race conditions during concurrent registration handling. It does not directly impact data confidentiality or integrity required by GDPR or HIPAA. However, service disruption could affect availability of communication systems, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade Kamailio to a version that includes the fix for CVE-2026-52023. Apply the patch from commit 722c06b to add NULL checks in sec_agree.c before memory free operations. Restrict concurrent REGISTER and de-REGISTER requests for the same UE to prevent race conditions.

Hi! I’m here to help you understand CVE-2026-52023. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...