CVE-2026-39864 Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks
Remote attackers can crash the Kamailio SIP server via crafted packets when specific authentication checks are enabled without a database backend.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39864?
CVE-2026-39864 is a medium-severity denial of service vulnerability in kamailio, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet if a successful user authentication without a database backend is followed by additional user identity checks. This vulnerability is fixed in 6.0.5 and 5.8.7.
Weakness: CWE-125
Which versions are affected by CVE-2026-39864?
It affects 1 product.
Products include Kamailio Kamailio.
How do I fix CVE-2026-39864?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-39864 being exploited?
There is no known exploitation of CVE-2026-39864 in the wild and no public exploit code.
Other vulnerabilities in kamailio
Sources
Also known as DEBIAN-CVE-2026-39864, GHSA-6m86-m342-g48m, UBUNTU-CVE-2026-39864.