Kamailio: Stack-based buffer overflow in ims_qos_npn module (CVE-2026-106804)

A stack-based buffer overflow vulnerability exists in Kamailio versions 6.1.3 and 6.1.4 within the ims_qos_npn module. The function w_rx_aar_register() copies the host field from a SIP Via header into a fixed 46-byte stack buffer without performing adequate length validation. An unauthenticated, remote attacker can trigger this vulnerability by sending a specially crafted SIP REGISTER request to the server.

Impact

The primary observed impact is application instability and process termination, resulting in a denial-of-service condition for the affected Kamailio instance. While the vulnerability involves a stack-based buffer overflow, the report identifies the outcome as denial of service.

Recommendation

• Inventory all Kamailio instances to identify deployments running versions 6.1.3 or 6.1.4.
• Monitor logs for malformed SIP traffic targeting the ims_qos_npn module.
• Upgrade affected Kamailio instances to a version where this vulnerability is remediated once a patch is available from the vendor.