Log in Start free

Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M

CVE-2026-39863Kamailio Core: TCP Data Processing Vulnerability

High 7.5

In plain English

A high-severity memory corruption in kamailio from kamailio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20kamailio5.8.8-r0ALPINE-CVE-2026-39863
Alpine:v3.21kamailio5.8.8-r0ALPINE-CVE-2026-39863
Alpine:v3.22kamailio6.0.6-r0ALPINE-CVE-2026-39863
Alpine:v3.23kamailio6.0.6-r0ALPINE-CVE-2026-39863
Alpine:v3.24kamailio6.0.6-r0ALPINE-CVE-2026-39863
Debian:12kamailiono fix listedDEBIAN-CVE-2026-39863
Debian:13kamailio6.0.1-1+deb13u2DEBIAN-CVE-2026-39863
Debian:14kamailio6.1.1-2DEBIAN-CVE-2026-39863
Ubuntu:22.04:LTSkamailiono fix listedUBUNTU-CVE-2026-39863
Ubuntu:24.04:LTSkamailiono fix listedUBUNTU-CVE-2026-39863
Ubuntu:25.10kamailiono fix listedUBUNTU-CVE-2026-39863
Ubuntu:26.04:LTSkamailiono fix listedUBUNTU-CVE-2026-39863
Ubuntu:26.10kamailiono fix listedUBUNTU-CVE-2026-39863

Affected products (as reported)

VendorProductVersions
kamailio kamailio < 5.8.8>= 6.0.0, < 6.0.6>= 6.1.0, < 6.1.1

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References