Description
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
Published: 2026-11-02
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A stack-based buffer overflow exists in Kamailio versions 6.1.3 and 6.1.4 within the ims_qos_npn module. The w_rx_aar_register() function copies the host field from the SIP Via header into a fixed 46-byte stack buffer without validating its length. An attacker can provide a host string longer than 46 bytes, causing stack corruption and termination of the affected Kamailio instance.

Affected Systems

Kamailio 6.1.3 and 6.1.4, specifically the ims_qos_npn module. No other vendors or products are listed as affected.

Risk and Exploitability

The vulnerability can be triggered by an unauthenticated remote attacker who sends a specially crafted SIP REGISTER request. Because the flaw is remote, does not require authentication, and can crash the application, the risk is high from an availability perspective. No EPSS data or KEV listing is available, but the lack of mitigation is the primary concern until the Kamailio instance is patched or the module disabled.

Generated by OpenCVE AI on November 2, 2026 at 18:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Kamailio to a version where the ims_qos_npn module has been fixed, such as 6.1.5 or later.
  • If the module is not required for your deployment, disable or remove the ims_qos_npn module to eliminate the vulnerable code path.
  • Implement network controls or SIP filtering rules to restrict access to the SIP registrar endpoint, reducing the attack surface while a patch is applied.

Generated by OpenCVE AI on November 2, 2026 at 18:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Title Stack-based Buffer Overflow in Kamailio ims_qos_npn Module Causing DoS
Weaknesses CWE-119

Mon, 02 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-02T18:55:18.235Z

Reserved: 2026-10-07T00:00:00.000Z

Link: CVE-2026-106804

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T17:17:33.453

Modified: 2026-11-02T17:17:33.453

Link: CVE-2026-106804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T18:30:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer