CVE-2026-39864

NameCVE-2026-39864
DescriptionKamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet if a successful user authentication without a database backend is followed by additional user identity checks. This vulnerability is fixed in 6.0.5 and 5.8.7.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kamailio (PTS)bullseye5.4.4-1vulnerable
bookworm5.6.3-2vulnerable
trixie6.0.1-1+deb13u1vulnerable
forky6.0.5-1fixed
sid6.1.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kamailiosource(unstable)6.0.5-1

Notes

https://github.com/kamailio/kamailio/security/advisories/GHSA-6m86-m342-g48m

Search for package or bug name: Reporting problems