Null Pointer Dereference Vulnerability in Kamailio Package
Summary
DEBIAN-CVE-2025-12206: A flaw has been found in Kamailio 5.5. Affects kamailio versions 5.4.4-1 – 6.0.3-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP server that provides a robust platform for handling VoIP communications. It is widely used for building scalable and flexible telephony applications. The package is designed to manage SIP signaling and can be integrated with various telephony services. However, a recent vulnerability has been identified that affects its stability and security.
Vulnerability Detail
A flaw has been discovered in Kamailio version 5.5, specifically in the function rve_is_constant located in the file src/core/rvalue.c. This vulnerability allows for a null pointer dereference, which can lead to application crashes or unexpected behavior. The attack must be executed locally, and an exploit has already been published, posing a risk to systems running vulnerable versions of Kamailio.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may restrict local access to the Kamailio service to prevent potential exploitation until a patch is applied. This can be done by configuring firewall rules to limit access to trusted IP addresses only.
Conclusion
The null pointer dereference vulnerability in Kamailio poses a significant risk to users of the software. It is crucial to update to the latest patched version to mitigate potential exploitation. Additionally, employing workarounds can help secure the application until a fix is applied.
See every vulnerability recorded for kamailio →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
No, the vulnerability requires local access to exploit, making it less likely to be exploited from the outside.
All versions of Kamailio starting from 0 up to the latest version prior to the patch are affected.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
