Use After Free Vulnerability in Kamailio Package
Summary
DEBIAN-CVE-2025-12205: A vulnerability was detected in Kamailio 5.5. Affects kamailio versions 5.4.4-1 – 6.0.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP server that is widely used for VoIP and real-time communications. It provides a robust platform for handling SIP signaling and offers features such as load balancing, NAT traversal, and presence management. The package is essential for developers and organizations looking to implement scalable communication solutions. However, a critical vulnerability has been identified in version 5.5, which could potentially compromise the security of applications relying on this package.
Vulnerability Detail
A vulnerability has been detected in Kamailio 5.5, specifically in the function sr_push_yy_state located in the src/core/cfg.lex file of the Configuration File Handler component. This vulnerability results in a use after free condition, which can be exploited by an attacker from a local position. The implications of this vulnerability are severe, as it could lead to unauthorized access, data corruption, or denial of service. The exploit is now public, and the vendor was contacted prior to the disclosure but did not respond.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Kamailio service to trusted local users only, thereby minimizing the risk of exploitation until a patch is applied.
Conclusion
The Kamailio package has a critical use after free vulnerability that poses significant risks to applications utilizing it. Immediate action is required to update to the patched version to ensure the security of your systems. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for kamailio →
FAQ
A use after free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, data corruption, or denial of service, severely impacting the security and functionality of applications using Kamailio.
Yes, a patched version of the Kamailio package is available. It is crucial to update to this version to mitigate the risk associated with the vulnerability.
The CVSS score of this vulnerability is 7.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
