CVE-2026-39864: 
NixOS vulnerability analysis and mitigation

CVE-2026-39864 is an out-of-bounds read vulnerability in the auth module of Kamailio, an open source SIP Signaling Server (formerly OpenSER and SER). It allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet when a successful user authentication without a database backend is followed by additional user identity checks. Affected versions include all Kamailio releases prior to 5.8.7 and versions 6.0.0 through 6.0.4. The vulnerability was published on April 8, 2026, and carries a CVSS v3.1 base score of 4.9 (Medium) per NVD, or 4.4 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in Kamailio's auth.so module. It is triggered under a specific deployment scenario: after a successful RFC2617 user authentication that does not use a database backend, if the application subsequently performs additional user identity checks, a specially crafted SIP packet can cause the auth module to read memory beyond the bounds of an allocated buffer, resulting in a process crash. The attack vector is network-based and requires no user interaction, but exploitation requires high privileges and high attack complexity, limiting the practical attack surface (GitHub Advisory).

Successful exploitation results in a denial of service through a crash of the affected Kamailio process, disrupting SIP signaling operations. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Environments relying on Kamailio for VoIP or unified communications infrastructure could experience service outages if targeted (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.204%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and a specific deployment configuration (non-database-backend authentication with subsequent identity checks), further reducing the likelihood of widespread exploitation.

1. Reconnaissance: Identify Kamailio SIP server instances running versions prior to 5.8.7 or 6.0.0–6.0.4 that are configured to perform user authentication without a database backend (e.g., using flat-file or in-memory credential stores).
2. Authentication: Authenticate successfully to the target Kamailio instance using valid credentials via RFC2617 digest authentication over SIP, establishing the precondition for the vulnerable code path.
3. Craft malicious SIP packet: Construct a specially crafted SIP packet designed to trigger additional user identity checks in the auth module after the initial authentication succeeds.
4. Send packet: Transmit the crafted SIP packet to the target server, causing the auth module to perform an out-of-bounds read during the identity check phase.
5. Trigger crash: The out-of-bounds read causes the Kamailio process to crash, resulting in a denial of service and disruption of SIP signaling (GitHub Advisory).

• Logs: Unexpected Kamailio process crash entries in system logs (e.g., /var/log/syslog or /var/log/kamailio/kamailio.log) referencing segmentation faults or abnormal termination of the kamailio process.
• Logs: SIP authentication log entries showing successful RFC2617 authentication from an unexpected or external source immediately preceding a process crash.
• Network: Unusual or malformed SIP packets (e.g., with anomalous headers or body content) originating from external IP addresses targeting the Kamailio SIP port (default UDP/TCP 5060).
• Process: Repeated restarts of the Kamailio daemon (e.g., via systemd or init) in a short time window, potentially indicating repeated crash-and-restart cycles triggered by an attacker.

Kamailio has released patched versions 5.8.7 (for the 5.x branch) and 6.0.5 (for the 6.x branch), and upgrading to these versions is the recommended remediation (GitHub Advisory, Kamailio Advisory). No official workaround is provided beyond upgrading; however, as an interim measure, administrators should implement network-level access controls (e.g., firewall rules) to restrict SIP traffic to trusted sources only, reducing the attack surface. Older branches (prior to 5.8/5.7) are not officially supported with packages and would require manual patching from the git repository.

The vulnerability was reported to Kamailio by SignalWire and published as a GitHub Security Advisory on April 7, 2026, with a moderate severity rating (GitHub Advisory). Kamailio published an official security advisory on their website covering this and a related core module issue (Kamailio Advisory). No significant broader media coverage or notable community discussion has been observed beyond standard CVE tracking and vulnerability database entries.