Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
CVE Vulnerability Database
Vulnerability Database/CVE-2026-52023

CVE-2026-52023: Kamailio IMS DoS Vulnerability

CVE-2026-52023 is a denial of service vulnerability in Kamailio IMS registrar PCSCF module affecting version 6.1.1 and earlier. Attackers can exploit security agreement parsing flaws to crash the service. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

Published:

CVE-2026-52023 Overview

CVE-2026-52023 affects Kamailio SIP server version 6.1.1 and earlier. The vulnerability resides in the ims_registrar_pcscf module, specifically within the pcscf_save_pending/save_pending code path and the security-agreement parser in sec_agree.c:parse_sec_agree(). A remote attacker can trigger a denial of service condition by exploiting a double free flaw in the shared memory management of IPsec security-agreement parameters. Kamailio deployments serving as Proxy-Call Session Control Function (P-CSCF) nodes in IP Multimedia Subsystem (IMS) environments are directly exposed. The issue was fixed via commit 722c06b3efc53ccb369ce812c685c7d069508187.

Critical Impact

Remote unauthenticated attackers can crash Kamailio P-CSCF instances by sending crafted SIP REGISTER messages containing malformed Security-Client headers, disrupting VoLTE and IMS voice services.

Affected Products

  • Kamailio SIP server versions 6.1.1 and earlier
  • Deployments using the ims_registrar_pcscf module
  • IMS/VoLTE infrastructure relying on Kamailio as a P-CSCF

Discovery Timeline

  • 2026-09-01 - CVE-2026-52023 published to NVD
  • 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-52023

Vulnerability Analysis

The vulnerability is a double free [CWE-415] in the ims_registrar_pcscf module of Kamailio. When Kamailio processes SIP REGISTER requests carrying Security-Client or Security-Verify headers, parse_sec_agree() in sec_agree.c allocates shared memory for IPsec parameters such as ealg, r_ealg, ck, alg, r_alg, ik, prot, and mod. During cleanup along the pcscf_save_pending/save_pending path, the same memory regions can be released more than once. Freeing the same shared memory block twice corrupts Kamailio's shared memory allocator state and terminates the worker process, producing a denial of service against the SIP registrar.

Root Cause

The root cause is unconditional invocation of shm_free() on IPsec parameter fields without first checking whether those pointers were already released or never allocated. Because these fields may be freed by other code paths during parsing or error handling, the subsequent cleanup performs a second free on the same address.

Attack Vector

The attack vector is remote and network-based. An attacker sends a crafted SIP REGISTER message with a malformed or partial Security-Client header to a Kamailio P-CSCF listener. Parsing failures inside parse_sec_agree() trigger the vulnerable cleanup path, causing shared memory corruption and process termination. Authentication is not required because the flaw is reached before registration completes.

c
// Patch from src/modules/ims_registrar_pcscf/sec_agree.c
// commit 722c06b3efc53ccb369ce812c685c7d069508187
 		shm_free(params->sec_header.s);
 		shm_free(params->data.ipsec);
 		if(params->type == SECURITY_IPSEC && params->data.ipsec) {
-			shm_free(params->data.ipsec->ealg.s);
-			shm_free(params->data.ipsec->r_ealg.s);
-			shm_free(params->data.ipsec->ck.s);
-			shm_free(params->data.ipsec->alg.s);
-			shm_free(params->data.ipsec->r_alg.s);
-			shm_free(params->data.ipsec->ik.s);
-			shm_free(params->data.ipsec->prot.s);
-			shm_free(params->data.ipsec->mod.s);
+			if(params->data.ipsec->ealg.s)
+				shm_free(params->data.ipsec->ealg.s);
+			if(params->data.ipsec->r_ealg.s)
+				shm_free(params->data.ipsec->r_ealg.s);
+			if(params->data.ipsec->ck.s)
+				shm_free(params->data.ipsec->ck.s);
+			if(params->data.ipsec->alg.s)
+				shm_free(params->data.ipsec->alg.s);
+			if(params->data.ipsec->r_alg.s)
+				shm_free(params->data.ipsec->r_alg.s);
+			if(params->data.ipsec->ik.s)
+				shm_free(params->data.ipsec->ik.s);
+			if(params->data.ipsec->prot.s)
+				shm_free(params->data.ipsec->prot.s);
+			if(params->data.ipsec->mod.s)
+				shm_free(params->data.ipsec->mod.s);
 			shm_free(params->data.ipsec);
 		}

Source: Kamailio GitHub Commit 722c06b. The patch guards each shm_free() call with a non-NULL pointer check, preventing the double free on partially initialized IPsec parameter structures.

Detection Methods for CVE-2026-52023

Indicators of Compromise

  • Unexpected termination or restart of Kamailio worker processes with shared memory errors in syslog or kamailio.log.
  • Log entries referencing parse_sec_agree or ims_registrar_pcscf shortly before a crash.
  • Bursts of SIP REGISTER traffic containing malformed Security-Client or Security-Verify headers from a single source.

Detection Strategies

  • Deploy SIP-aware intrusion detection signatures that flag REGISTER messages with truncated or invalid Security-Client header parameters (ealg, alg, ck, ik, prot, mod).
  • Correlate SIP protocol errors with Kamailio worker restarts to detect exploitation attempts targeting the P-CSCF.
  • Monitor for repeated shm_free warnings or SIGSEGV events on Kamailio hosts.

Monitoring Recommendations

  • Track Kamailio process uptime and restart counts through the kamctl or kamcmd monitoring interfaces.
  • Alert on abnormal REGISTER-to-response ratios per source IP against the P-CSCF listener.
  • Forward Kamailio logs to a centralized logging platform and alert on the string patterns sec_agree, double free, or shm_free.

How to Mitigate CVE-2026-52023

Immediate Actions Required

  • Upgrade Kamailio to a version that includes commit 722c06b3efc53ccb369ce812c685c7d069508187 or later.
  • If patching is not immediately possible, disable or unload the ims_registrar_pcscf module in kamailio.cfg where feasible.
  • Restrict access to SIP listeners so only trusted IMS access networks can reach the P-CSCF.

Patch Information

The fix is available in the upstream Kamailio repository. See the Kamailio GitHub Commit 722c06b and the related Kamailio Issue #4671 discussion. Rebuild the ims_registrar_pcscf module from patched sources and redeploy across all P-CSCF nodes.

Workarounds

  • Apply upstream rate limiting (pike or htable counters) to SIP REGISTER traffic to reduce crash-loop impact.
  • Front Kamailio with a SIP-aware proxy or session border controller that validates Security-Client header syntax before forwarding.
  • Use process supervisors such as systemd with automatic restart to reduce service outage windows until patching completes.
bash
# Verify installed Kamailio version and patched commit
kamailio -V
cd /usr/src/kamailio
git log --oneline | grep 722c06b3efc53ccb369ce812c685c7d069508187

# Optional: disable ims_registrar_pcscf if not required
# In kamailio.cfg, comment out:
# loadmodule "ims_registrar_pcscf.so"
systemctl restart kamailio

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne