CVE-2026-39863

Kamailio Core: TCP Data Processing Vulnerability

CVSS 7.5 HIGHEPSS 0.5%CWE-119

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

kamailio · kamailio

References

https://github.com/kamailio/kamailio/security/advisories/GHSA-2wj4-f825-2h2f