An out‑of‑bounds read in the auth module of Kamailio allows an attacker to force the SIP server to crash. The flaw becomes exploitable when a user authenticates successfully without a database backend and then additional identity checks are performed. The result is a process crash that leads to a denial of service. This issue is a classic out‑of‑bounds read problem, classified under CWE‑125.

The vulnerability affects Kamailio versions earlier than 6.0.5 and 5.8.7. The affected component is the auth module of the SIP signaling server. Systems running Kamailio 6.x prior to 6.0.5 or 5.x before 5.8.7 are at risk, regardless of the deployment environment.

The CVSS score of 4.4 indicates moderate severity. EPSS information is not available, so the exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time. The likely attack vector is a remote attacker sending a specially crafted SIP packet after a successful authentication, though the description does not explicitly state the network context, it is inferred that the attack requires remote network access to the Kamailio server.