Buffer Overflow Vulnerability in Kamailio Package
Summary
DEBIAN-CVE-2026-108822: A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. Affects kamailio versions 5.6.3-2 – 6.1.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP server that is widely used for handling VoIP communications. It is designed to manage thousands of calls and offers features such as load balancing, routing, and security. The Kamailio package is critical for applications that rely on SIP for real-time communication. However, versions up to 6.0.7 and 6.1.3 are vulnerable to a buffer overflow issue that can be exploited remotely.
Vulnerability Detail
A vulnerability was detected in the Kamailio package, specifically in the function isup_get_calling_party located in src/modules/sipt/ss7_parser.c of the sipt Module. This vulnerability arises from improper handling of the argument length, leading to a buffer overflow. An attacker can exploit this vulnerability remotely, potentially causing application crashes or unauthorized access to sensitive data. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, it is essential to upgrade the Kamailio package to a patched version. Users should update to version 6.0.8 or 6.1.4. The upgrade can be performed using the following command in the terminal:
sudo apt-get update && sudo apt-get install kamailio
This will ensure that the system is running a secure version of the package.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version as mentioned above.
Conclusion
The buffer overflow vulnerability in the Kamailio package poses a significant risk to users of versions up to 6.0.7 and 6.1.3. It is crucial to upgrade to the patched versions to ensure the security and stability of your applications. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain a secure environment.
See every vulnerability recorded for kamailio →
FAQ
The vulnerability is a buffer overflow issue caused by improper handling of argument lengths in the isup_get_calling_party function.
An attacker can exploit this vulnerability remotely, potentially leading to application crashes or unauthorized access.
Kamailio versions up to 6.0.7 and 6.1.3 are affected by this vulnerability.
The recommended action is to upgrade to Kamailio version 6.0.8 or 6.1.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.