CVE-2026-52023: High Denial of Service in Kamailio IMS P-CSCF

CVE-2026-52023 is a high severity (CVSS 7.5) denial of service in the Kamailio SIP server. A remote attacker can trigger it through the ims_registrar_pcscf module, in the pending save path and security-agreement parsing. Kamailio 6.1.1 and earlier are affected; check the fix status below.

What's affected

• Kamailio 6.1.1 and earlier, per the record.
• The affected code is the ims_registrar_pcscf module, specifically the pcscf_save_pending and save_pending path and security-agreement parsing in sec_agree.c, function parse_sec_agree().

I could not confirm a fixed release number from the sources I read. The record links an upstream commit, and the project issue (number 4671) discusses the P-CSCF path during concurrent REGISTER and de-REGISTER handling. Check the Kamailio release notes and your distribution's package changelog for a build that includes the commit.

The module is used in IMS deployments. A plain SIP proxy that does not load it is not described as affected.

How to check if you're exposed

Print the version:

kamailio -v

Then check whether the vulnerable module is loaded in your configuration:

grep -rn "ims_registrar_pcscf" /etc/kamailio/

If the module is not loaded, the described path is not in use on that node. If it is loaded and the version is 6.1.1 or earlier, treat it as exposed until you have confirmed a patched build.

What to do now

1. Find the Kamailio release or package build that includes upstream commit 722c06b and upgrade to it.
2. If you build from source, rebuild from a revision that includes the commit.
3. If you cannot patch yet, limit which networks can send SIP traffic to P-CSCF nodes to known peers.
4. Put process supervision and alerting around Kamailio so a crash is seen and the service restarts.
5. Watch the project issue tracker for a release note that names this CVE.

Why it matters

The record lists CWE-400, uncontrolled resource consumption, and CWE-415, double free. A double free happens when the same memory is released twice. That corrupts the allocator's state and often crashes the process. The issue title points to concurrent REGISTER and de-REGISTER handling, which is the kind of timing where one code path frees memory another still holds.

For a SIP edge component, a remote crash means calls and registrations drop until restart. The record does not mark this CVE as known exploited, and I found no statement of exploitation in the sources I read.

Quick check

Sources

• Kamailio issue 4671

Last reviewed: 18 October 2026.