CVE-2026-106804
Received Received - Intake

Stack-Based Buffer Overflow in Kamailio ims_qos_npn Module

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MITRE

Description
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-106804

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-106804 is a stack-based buffer overflow in Kamailio versions v6.1.3 and v6.1.4 within the ims_qos_npn module. The vulnerability occurs in the w_rx_aar_register() function, which copies the host field from a SIP Via header into a fixed 46-byte stack buffer without length validation. An unauthenticated remote attacker can exploit this by sending a crafted SIP REGISTER request with an oversized host field, causing stack corruption and crashing the Kamailio instance, leading to denial of service.

Detection Guidance

To detect this vulnerability, monitor Kamailio logs for crashes or segmentation faults in the ims_qos_npn module. Check for malformed SIP REGISTER requests with oversized Via headers. Use network traffic analysis tools like Wireshark to inspect SIP messages for unusually long host fields in Via headers.

Impact Analysis

This vulnerability can cause the Kamailio VoLTE/VoNR P-CSCF component to crash, disrupting IMS services for connected users. Active calls may drop, and emergency services could be interrupted. The attack requires only a single UDP datagram with a malformed REGISTER request, making it easy to trigger remotely.

Compliance Impact

This vulnerability primarily causes denial of service by crashing Kamailio instances, which could disrupt VoLTE/VoNR P-CSCF services. While not directly violating GDPR or HIPAA, such disruptions may impact availability of critical communications, potentially affecting compliance with requirements for reliable access to emergency services or data processing integrity.

Mitigation Strategies

Immediately upgrade Kamailio to a patched version where the ims_qos_npn module includes length validation for the Via header host field. If upgrading is not possible, disable the ims_qos_npn module or restrict access to the SIP port via firewall rules to prevent unauthenticated REGISTER requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...