Kamailio
13 CVEs across 1 Kamailio products. Browse Kamailio vulnerabilities, severities, and proof-of-concept exploits.
Kamailio products with known CVEs
Kamailio CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-39864 | Medium | 4.4 | 2026-04-08 | Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly O… |
CVE-2026-39863 | High | 7.5 | 2026-04-08 | Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerl… |
CVE-2025-12207 | Low | 3.3 | 2025-10-27 | A vulnerability has been found in Kamailio 5.5. This affects the function yyerror_at of the file src/core/cfg.y of the component Grammar Rule Handler. Such man… |
CVE-2025-12206 | Low | 3.3 | 2025-10-27 | A flaw has been found in Kamailio 5.5. The impacted element is the function rve_is_constant of the file src/core/rvalue.c. This manipulation causes null pointe… |
CVE-2025-12205 | Medium | 5.3 | 2025-10-27 | A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration… |
CVE-2025-12204 | Medium | 5.3 | 2025-10-27 | A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rve_destroy of the file src/core/rvalue.c of the component Configuration F… |
CVE-2020-27507 | Critical | 9.8 | 2023-03-15 | The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server… |
CVE-2020-28361 | Medium | 5.4 | 2020-11-18 | Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protecti… |
CVE-2018-16657 | Critical | 9.8 | 2018-09-07 | In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason… |
CVE-2018-14767 | Critical | 9.8 | 2018-07-31 | In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. T… |
CVE-2018-8828 | Critical | 9.8 | 2018-03-20 | A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malfor… |
CVE-2015-1590 | High | 7.8 | 2017-09-07 | The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. |
CVE-2013-7426 | Critical | 9.8 | 2017-08-29 | Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1. |
CVE-2015-1591 | High | 7.8 | 2017-06-27 | The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. |
CVE-2016-2385 | Critical | 9.8 | 2016-04-11 | Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote atta… |