CVE-2026-108822 Details
Description
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.
A buffer overflow vulnerability has been identified in Kamailio versions prior to 6.0.8 and 6.1.4. The issue arises in the sipt module, specifically within the ISUP message parser function isup_get_calling_party. The vulnerability can be exploited remotely by manipulating the length of the argument, leading to potential memory corruption.
Users are advised to upgrade to Kamailio versions 6.0.8 or 6.1.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kamailio/kamailio/ | [email protected] | Source CodeVendor |
| https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21 | [email protected] | Source CodeVendor |
| https://github.com/kamailio/kamailio/pull/4905 | [email protected] | Issue TrackingVendor |
| https://github.com/kamailio/kamailio/releases/tag/6.0.8 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-108822 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/964495 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416599 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416599/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kamailio | <= 6.0.7 (semver) <= 6.1.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |