CVE-2026-39863CWE-119

Kamailio Core: TCP Data Processing Vulnerability

High · published April 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2026-04-08T19:55Z
EPSS history
Timeline
  • 08 APR 19:55Z
    Kamailio Core: TCP Data Processing Vulnerability
    cvelistv5