Kamailio 6.1.3と6.1.4に脆弱性、修正コミット公開
Summary
Kamailio 6.1.3と6.1.4のP-CSCF向けモジュールに、認証なしでプロセスを停止させられる脆弱性が見つかりました。IMS基盤を運用する組織は、該当の版とモジュールの使用を確認し、修正を含む版へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Kamailio 6.1.3と6.1.4のP-CSCF向けモジュールに、認証なしでプロセスを停止させられる脆弱性が見つかりました。IMS基盤を運用する組織は、該当の版とモジュールの使用を確認し、修正を含む版へ更新してください。
Fix status by distribution
Fixed packages published by each distribution for this CVE Fixed versions differ by release; check each link.
- Ubuntu UBUNTU-CVE-2026-106803 kamailio
Original description The description as published by the source.
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- report github.com
- web gist.github.com
- web github.com