Kamailio DoS via IMS Registrar PCSCF Module

Executive Summary

This vulnerability is a denial of service issue in Kamailio versions 6.1.1 and earlier. It occurs in the ims_registrar_pcscf module when handling concurrent REGISTER and de-REGISTER requests for the same user equipment. A race condition during security-agreement parsing leads to inconsistent internal state and crashes the system with a segmentation fault.

Useful 0 Not Useful 0

Detection Guidance

Monitor Kamailio logs for warnings from sec_agree.c, such as 'qm_free(): WARNING: free(0) called from ims_registrar_pcscf: sec_agree.c: parse_sec_agree(...)'. Check for crashes with signal 11 (segmentation fault) in core dumps during high-rate concurrent REGISTER and de-REGISTER requests for the same UE.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause Kamailio servers to crash repeatedly, disrupting VoIP services and communication systems. It specifically affects the P-CSCF component handling registration traffic, potentially leading to service outages during high concurrent registration attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service through crashes in Kamailio's P-CSCF module due to race conditions during concurrent registration handling. It does not directly impact data confidentiality or integrity required by GDPR or HIPAA. However, service disruption could affect availability of communication systems, potentially impacting compliance with availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kamailio to a version that includes the fix for CVE-2026-52023. Apply the patch from commit 722c06b to add NULL checks in sec_agree.c before memory free operations. Restrict concurrent REGISTER and de-REGISTER requests for the same UE to prevent race conditions.

Useful 0 Not Useful 0