Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-08 | 1 | Disclosure1 |
| 2026-04-23 | 1 | Patch1 |
3/ Infrastructure patch round: Kamailio core TCP crash (CVE-2026-39863), PJSIP 2.17 with 13 advisories, coturn 4.10.0 with more fixes than the advisory says, and 3 Linux kernel SIP/H.323 helper CVEs.
Post summary
The post announces an infrastructure patch round covering multiple CVEs—including Kamailio, PJSIP, coturn, and Linux kernel SIP/H.323 helpers—highlighting the availability of related patches.
CVE-2026-39863 Out-of-Bounds Access Denial of Service in Kamailio Prior to 5.8.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39863
Post summary
The text announces CVE‑2026‑39863, a denial‑of‑service vulnerability in Kamailio versions before 5.8.8, offering only a brief type description and a link to a vulnerability details page.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kamailio | kamailio | - | - | - |
| App | kamailio | kamailio | 6.1.0 | - | - |