{"id":"CVE-2026-106804","published":"2026-11-02T17:17:33.453","lastModified":"2026-11-02T19:34:23.993","description":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-20","CWE-120","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/hackeryounow/f5af75502ea6df600428c46bb9bbf39e","tags":[]},{"url":"https://github.com/kamailio/kamailio/issues/4953","tags":[]},{"url":"https://github.com/kamailio/kamailio/issues/4953","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/hackeryounow/f5af75502ea6df600428c46bb9bbf39e","tags":[]},{"url":"https://github.com/kamailio/kamailio/issues/4953","tags":[]},{"url":"https://github.com/kamailio/kamailio/issues/4953","tags":[]}],"hasPoc":true,"ai":null}