CVE-2026-106803

Name of the Vulnerable Software and Affected Versions Kamailio versions 6.1.3 through 6.1.4

Description A stack-based buffer overflow occurs in the ims registrar pcscf module. The process contact() function copies a port value from the alias parameter of a crafted application/reginfo+xml NOTIFY message into a fixed 5-byte stack buffer without validating the length. An unauthenticated remote attacker can exploit this to cause stack corruption and terminate the P-CSCF process, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.