CVE-2026-108822
- Source
- https://cve.org/CVERecord?id=CVE-2026-108822
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108822.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-108822
- Downstream
- Published
- 2026-10-12T10:00:16Z
- Modified
- 2026-10-28T10:51:13Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
- Summary
- Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow
- Details
-
A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-119", "CWE-120" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108822.json" }- References
-
- https://github.com/kamailio/kamailio/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108822.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-108822
- https://vuldb.com/cve/CVE-2026-108822
- https://vuldb.com/submit/964495
- https://vuldb.com/vuln/416599
- https://vuldb.com/vuln/416599/cti
- https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21
- https://github.com/kamailio/kamailio/pull/4905
- https://github.com/kamailio/kamailio/releases/tag/6.0.8
Affected packages
Git / github.com/kamailio/kamailio
Affected ranges
- Type
- GIT
- Repo
- https://github.com/kamailio/kamailio
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "6.0.0" }, { "last_affected": "6.0.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.1" }, { "last_affected": "6.0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.2" }, { "last_affected": "6.0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.3" }, { "last_affected": "6.0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.4" }, { "last_affected": "6.0.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.5" }, { "last_affected": "6.0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.6" }, { "last_affected": "6.0.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.0.7" }, { "last_affected": "6.0.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.1.0" }, { "last_affected": "6.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.1.1" }, { "last_affected": "6.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.1.2" }, { "last_affected": "6.1.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "6.1.3" }, { "last_affected": "6.1.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "3667bebf8d0bea07ed16218fd921d07db87aeb21" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "6.0.8", "range": [ { "fixed": "73c93991e31cea52304b96e7bc5b3d1c9f3caa33" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108822.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "206197839832113979566392835011807512096",
"length": 436
},
"id": "CVE-2026-108822-0042db58",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_called_party"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"98890157443090185889010446347992573808",
"332696548945638007188080907547885233952",
"280690153852059359649011220314666642546",
"200404806263260363956905335662801690862",
"46343692780931360943938005557354240431",
"294153053217287048702102500552284949543",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"89621960904845511019758133538243033909",
"110073784420907304698324737583510980546",
"268632933962601165011835251699094569921",
"259819148523801553650558613595856252946",
"279251817061204903988038584340699009517",
"165235853791423103550513472491765010633",
"53648769301212275890884927760117807694",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"127042406575342684780446878327408360506",
"100378946674266052364765316406865544418",
"24954394451498385248141014125175055635",
"81004985864883053918711575097398987131",
"55446085241947883159428872761344835057",
"316683184608833313713752151256822105496",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"89621960904845511019758133538243033909",
"47891189037117437428197272893287525508",
"162680930844156366188982528302539160035",
"280690153852059359649011220314666642546",
"200404806263260363956905335662801690862",
"46343692780931360943938005557354240431",
"294153053217287048702102500552284949543",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"89621960904845511019758133538243033909",
"304920538727045532685399963320440012240",
"56518346871637376589477352397842372565",
"280690153852059359649011220314666642546",
"200404806263260363956905335662801690862",
"46343692780931360943938005557354240431",
"294153053217287048702102500552284949543",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"89621960904845511019758133538243033909",
"55904795356185789415262227197619246275",
"32744107499614671422084297832381257766",
"71379719306406253011139149157747312172",
"285362921923733019512107840124120575449",
"64493458897533524167316447878508049189",
"238928666610000123285377738137240454085",
"195574957821354155317929238297348320845",
"131375987508821152828869280892393051756",
"193907558430059842605040963242733899269",
"89621960904845511019758133538243033909"
],
"threshold": 0.9
},
"id": "CVE-2026-108822-09f02a45",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "306020151404896109942709475273746479621",
"length": 569
},
"id": "CVE-2026-108822-0b81b702",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_redirection_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206197839832113979566392835011807512096",
"length": 436
},
"id": "CVE-2026-108822-29df3e35",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_generic_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206197839832113979566392835011807512096",
"length": 436
},
"id": "CVE-2026-108822-2a5b3f9f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_original_called_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "225502347258341616415318343761042790561",
"length": 652
},
"id": "CVE-2026-108822-3790090b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_calling_party"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45717898051427049590421825159955974665",
"length": 647
},
"id": "CVE-2026-108822-76f72e3c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_generic_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "282405493743209078606585284289912106178",
"length": 788
},
"id": "CVE-2026-108822-a1bb80eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_called_party"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "304807568221816503535117649352866022373",
"length": 443
},
"id": "CVE-2026-108822-a3066c21",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_redirection_number"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"184022960338769494972303152673403778473",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"29259802547102687645636747256168705660",
"284403216262877770460656606868975270967",
"311093982408518188596722770269389017082",
"10239227009956929907735623197632086160",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"21967575531768365279063309897457096805",
"132660204545807762571725674124907581142",
"113943597955735309168851608806199684924",
"320863577228054565824702208516535309981",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"29259802547102687645636747256168705660",
"284403216262877770460656606868975270967",
"311093982408518188596722770269389017082",
"272231783328525936251997074216184216519",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"29259802547102687645636747256168705660",
"284403216262877770460656606868975270967",
"311093982408518188596722770269389017082",
"263678416162641331714750157211240899956",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"29259802547102687645636747256168705660",
"284403216262877770460656606868975270967",
"311093982408518188596722770269389017082",
"326808988179882988275728618507698729390",
"62883172220521839395305412014325476647",
"234550729397667593553498639467734113026",
"29259802547102687645636747256168705660",
"284403216262877770460656606868975270967",
"311093982408518188596722770269389017082"
],
"threshold": 0.9
},
"id": "CVE-2026-108822-b93ad958",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "312940241143354109571609543438684758843",
"length": 653
},
"id": "CVE-2026-108822-c2152ba7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_redirecting_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206197839832113979566392835011807512096",
"length": 436
},
"id": "CVE-2026-108822-cd507c3c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_calling_party"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217308723011105286001786244463826882158",
"length": 654
},
"id": "CVE-2026-108822-d1f84b4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/ss7_parser.c",
"function": "isup_get_original_called_number"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206197839832113979566392835011807512096",
"length": 436
},
"id": "CVE-2026-108822-f3d1ab21",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/kamailio/kamailio/commit/3667bebf8d0bea07ed16218fd921d07db87aeb21",
"target": {
"file": "src/modules/sipt/sipt.c",
"function": "sipt_get_redirecting_number"
}
}
]
vanir_signatures_modified
"2026-10-28T10:51:13Z"