CVE-2026-39863: 
NixOS vulnerability analysis and mitigation

CVE-2026-39863 is an out-of-bounds memory access vulnerability in the core TCP data processing component of Kamailio, an open-source SIP Signaling Server (formerly OpenSER and SER). It allows unauthenticated remote attackers to crash Kamailio processes by sending a specially crafted TCP packet, resulting in denial of service. Affected versions include all releases prior to 5.8.8, 6.0.x prior to 6.0.6, and 6.1.0 (prior to 6.1.1). The vulnerability was published on April 8, 2026, and patched versions were released on April 7, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Kamailio Advisory).

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119), with characteristics of an out-of-bounds read (CWE-125), located in the core TCP data processing logic of Kamailio. An unauthenticated remote attacker can send a specially crafted data packet over TCP to a vulnerable Kamailio instance, triggering the out-of-bounds access and causing the affected process to crash. Exploitation requires no privileges and no user interaction; the only precondition is that the target Kamailio instance must have TCP or TLS listeners configured and active. The vulnerability was reported by security researcher Younghyo Cho (yhcho0405) (GitHub Advisory).

Successful exploitation causes a denial of service by crashing the affected Kamailio process, disrupting SIP signaling services for any deployment with TCP or TLS listeners enabled. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. In environments where Kamailio serves as a critical SIP infrastructure component (e.g., VoIP platforms, unified communications systems), repeated exploitation could result in sustained service outages (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.106%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection signatures are available via Nessus (plugin 305796) and Qualys (detection ID 6563656) (Feedly).

1. Reconnaissance: Identify internet-facing Kamailio instances using network scanning tools (e.g., Shodan, Censys, or nmap) by searching for open SIP/TCP ports (default port 5060/TCP or 5061/TCP for TLS). Confirm the target is running a vulnerable version (prior to 5.8.8, 6.0.6, or 6.1.1).
2. Confirm TCP/TLS listener: Verify that the target Kamailio instance has TCP or TLS listeners active (as opposed to UDP-only), which is required for the vulnerability to be exploitable.
3. Craft malicious TCP packet: Construct a specially crafted SIP-over-TCP data packet designed to trigger the out-of-bounds memory access in Kamailio's core TCP data processing logic. The exact packet structure is not publicly documented, but it involves malformed or unexpected data that violates expected buffer boundaries.
4. Send packet to target: Transmit the crafted packet to the Kamailio TCP/TLS listener port. No authentication or prior session establishment is required.
5. Achieve denial of service: The out-of-bounds access causes the Kamailio worker process handling the connection to crash, resulting in service disruption for SIP signaling (GitHub Advisory).

• Network: Unexpected or malformed TCP connections to Kamailio SIP ports (5060/TCP, 5061/TCP) from unknown or suspicious source IPs; high-frequency connection attempts from a single source.
• Logs: Kamailio process crash entries in system logs (e.g., /var/log/syslog or /var/log/kamailio/kamailio.log) showing segmentation faults or abnormal termination of worker processes; repeated restarts of the Kamailio service.
• Process: Unexpected termination of Kamailio child processes (visible via ps, systemctl status kamailio, or process monitoring tools); core dump files generated in the Kamailio working directory following crashes.
• System: Increased frequency of watchdog or supervisor restarts of the Kamailio service correlating with inbound TCP traffic spikes.

Kamailio has released patched versions addressing this vulnerability: 5.8.8, 6.0.6, and 6.1.1. All users should upgrade to one of these versions as the primary remediation. No configuration-based workaround is officially provided; however, as an interim measure, restricting TCP/TLS listener exposure via firewall rules (e.g., limiting access to trusted IP ranges) can reduce attack surface while patching is underway. Network-level monitoring for unusual TCP traffic patterns targeting Kamailio services is also recommended during the transition (GitHub Advisory, Kamailio Advisory).

The Kamailio project published an official security advisory on April 7, 2026, disclosing the vulnerability alongside a related auth module advisory (Kamailio Advisory). The vulnerability received coverage from automated CVE tracking services and was noted on Mastodon by The Hacker Wire. A NixOS/nixpkgs issue was opened to track the update for that ecosystem (GitHub NixOS Issue). Community reaction has been measured, consistent with the limited exploitation risk and straightforward patch availability.