CVE-2026-106803: Critical Kamailio Buffer Overflow Vulnerability

What is CVE-2026-106803 in Kamailio?

CVE-2026-106803 is a critical stack-based buffer overflow vulnerability affecting Kamailio v6.1.3 and v6.1.4 inside the ims_registrar_pcscf module, documented in the NIST vulnerability database.

The flaw occurs when processing a crafted application/reginfo+xml NOTIFY message where the process_contact() function copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length.

Who is affected by this vulnerability?

The vulnerability directly impacts systems running Kamailio v6.1.3 and v6.1.4 that utilize the ims_registrar_pcscf module.

An unauthenticated remote attacker can exploit this weakness to trigger stack corruption and terminate the P-CSCF process, leading to a complete denial of service as detailed in CVE tracking records.

How do I protect my system?

Administrators should review the technical details in GitHub repository discussions and apply the official fix immediately to prevent service disruption.

To secure your environment against this issue, follow the mitigation steps below to update your software and monitor system logs.

Frequently asked questions

Which Kamailio versions are affected by CVE-2026-106803?

CVE-2026-106803 affects Kamailio versions v6.1.3 and v6.1.4.

Why does this vulnerability have a CVSS score of 9.8?

It has a CVSS score of 9.8 because an unauthenticated remote attacker can trigger a denial of service.

How can administrators mitigate this buffer overflow issue?

You should apply the official commit patch or update your software to a fixed version.