CVE-2026-52022: Kamailio IMS P-CSCF DOS Vulnerability

CVE-2026-52022 Overview

CVE-2026-52022 is a denial-of-service vulnerability in Kamailio version 6.1.1 and earlier. The flaw resides in the IMS Proxy Call Session Control Function (P-CSCF) registration handling components, specifically in the ims_usrloc_pcscf module. A remote attacker can trigger the condition over the network without authentication or user interaction, causing service disruption on affected SIP infrastructure. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption and stems from a double memory free condition in the P-CSCF contact security data handling code.

Critical Impact
Unauthenticated remote attackers can crash Kamailio SIP servers handling IMS P-CSCF registrations, disrupting voice and multimedia communications for all connected subscribers.

Affected Products

Kamailio SIP Server version 6.1.1
Kamailio versions prior to 6.1.1
Deployments using the ims_usrloc_pcscf module for IMS P-CSCF functionality

Discovery Timeline

2026-09-01 - CVE-2026-52022 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-52022

Vulnerability Analysis

The vulnerability affects the ims_usrloc_pcscf module, which manages user location data for the IMS P-CSCF role in Kamailio. The module handles registration state and security parameters (IPsec keys, algorithms, protection profiles) associated with SIP contacts. When processing registration events, the code path releasing security context memory does not verify pointer validity before invoking shm_free(). Repeated or malformed registration traffic can drive the module into a double-free state, corrupting the shared memory allocator and terminating the Kamailio process.

Root Cause

The root cause is the absence of null-pointer and prior-free checks in the security context deallocation routine within src/modules/ims_usrloc_pcscf/pcontact.c. Fields such as _p->sec_header.s and members of _p->data.ipsec were freed unconditionally, allowing the same shared-memory blocks to be released twice under specific registration flows.

Attack Vector

The attack is network-based and unauthenticated. An attacker sends crafted SIP REGISTER traffic to a Kamailio server acting as an IMS P-CSCF. By influencing the registration state machine and its security context lifecycle, the attacker forces the vulnerable code path to double-free shm allocations, aborting the daemon.

// Patch from src/modules/ims_usrloc_pcscf/pcontact.c
// Fixes double free in P-CSCF security context handling
     if (!_p)
         return;
 
-    shm_free(_p->sec_header.s);
+	if(_p->sec_header.s)
+		shm_free(_p->sec_header.s);
 
     switch (_p->type)
     {
         case SECURITY_IPSEC:
-            shm_free(_p->data.ipsec->ealg.s);
-            shm_free(_p->data.ipsec->r_ealg.s);
-            shm_free(_p->data.ipsec->ck.s);
-            shm_free(_p->data.ipsec->alg.s);
-            shm_free(_p->data.ipsec->r_alg.s);
-            shm_free(_p->data.ipsec->ik.s);
-            shm_free(_p->data.ipsec->prot.s);
-            shm_free(_p->data.ipsec->mod.s);
-
-            shm_free(_p->data.ipsec);
+			if(_p->data.ipsec){
+				if(_p->data.ipsec->ealg.s)		shm_free(_p->data.ipsec->ealg.s);
+				if(_p->data.ipsec->r_ealg.s)	shm_free(_p->data.ipsec->r_ealg.s);
+				if(_p->data.ipsec->ck.s)		shm_free(_p->data.ipsec->ck.s);
+				if(_p->data.ipsec->alg.s)		shm_free(_p->data.ipsec->alg.s);
+				if(_p->data.ipsec->r_alg.s)		shm_free(_p->data.ipsec->r_alg.s);
+				if(_p->data.ipsec->ik.s)		shm_free(_p->data.ipsec->ik.s);
+				if(_p->data.ipsec->prot.s)		shm_free(_p->data.ipsec->prot.s);
+				if(_p->data.ipsec->mod.s)		shm_free(_p->data.ipsec->mod.s);
+
// Source: [Kamailio commit 91c5ca7](https://github.com/kamailio/kamailio/commit/91c5ca751799db4f25a28a495350cc97f7c2f390)

Detection Methods for CVE-2026-52022

Indicators of Compromise

Unexpected kamailio process crashes or restarts logged by the service manager, particularly with SIGABRT or SIGSEGV signals.
Shared-memory corruption messages such as qm_free or shm_free warnings in the Kamailio syslog output.
Bursts of malformed or repeated SIP REGISTER requests targeting the P-CSCF interface preceding a crash.

Detection Strategies

Inspect Kamailio logs for entries referencing ims_usrloc_pcscf, pcontact, or double-free diagnostics from the shared memory manager.
Correlate SIP REGISTER traffic volume and failure rates with process restart events using SIP-aware monitoring.
Compare deployed Kamailio binary versions against 6.1.1 and earlier to identify vulnerable hosts.

Monitoring Recommendations

Enable process supervision alerts (systemd, monit) to notify on any unplanned Kamailio termination.
Capture SIP traffic at the P-CSCF perimeter and retain packets around crash windows for forensic replay.
Track shared-memory usage metrics exported by Kamailio to detect anomalous allocation churn.

How to Mitigate CVE-2026-52022

Immediate Actions Required

Upgrade Kamailio to a release that includes commit 91c5ca7, which patches the ims_usrloc_pcscf double-free.
Restrict inbound SIP REGISTER traffic to trusted access networks and known subscriber IP ranges.
Deploy rate limiting on registration flows using the pike or htable modules to blunt flood attempts.

Patch Information

The upstream fix is available in the Kamailio repository as commit 91c5ca751799db4f25a28a495350cc97f7c2f390, which adds null-pointer guards before each shm_free() call in pcontact.c and refactors security-context teardown. Full technical context is available in the Kamailio GitHub issue #4670 and the patch commit.

Workarounds

Disable the ims_usrloc_pcscf module where IMS P-CSCF functionality is not required for the deployment.
Front the Kamailio P-CSCF instance with a SIP-aware firewall or Session Border Controller that filters malformed REGISTER messages.
Apply strict SIP message validation using the sanity module to reject non-conformant registration requests before they reach the vulnerable code path.

bash

# Example: rate limit REGISTER requests per source IP with pike
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 20)
modparam("pike", "remove_latency", 4)

if (is_method("REGISTER")) {
    if (!pike_check_req()) {
        xlog("L_ALERT","pike blocking $si\n");
        exit;
    }
}