Kamailio vulnerabilities
We track 6 vulnerabilities in Kamailio products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 20, 2026.
Latest Kamailio vulnerabilities
- 8.3 High severity
Kamailio: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer
- 7.5 High severity
Kamailio: Double Free
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()
- 7.4 High severity
Kamailio: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be p
- 7.5 High severity
kamailio: Improper Restriction of Operations within the Bounds of a Memory Buffer
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a special
- 7.8 High severity
Kamailio: Use After Free
A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local
- 7.8 High severity
Kamailio: Out-of-bounds Write
A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rve_destroy of the file src/core/rvalue.c of the component Configuration File Handler. The manipulation leads to heap-based buffer overflow. The attack must be carried out loc