CVE-2026-108822

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108822
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108822.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108822
Downstream
Published
2026-10-12T10:00:16Z
Modified
2026-10-15T02:47:21Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow
Details

A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119",
        "CWE-120"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108822.json"
}
References

Affected packages

Git / github.com/kamailio/kamailio

Affected ranges

Type
GIT
Repo
https://github.com/kamailio/kamailio
Events
Introduced
94a546d5e68a484daf64373c047ff5f3c8a927b7
Fixed
3667bebf8d0bea07ed16218fd921d07db87aeb21
Fixed
73c93991e31cea52304b96e7bc5b3d1c9f3caa33
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "6.0.0"
        },
        {
            "last_affected":  "6.0.0"
        },
        {
            "introduced":  "6.0.1"
        },
        {
            "last_affected":  "6.0.1"
        },
        {
            "introduced":  "6.0.2"
        },
        {
            "last_affected":  "6.0.2"
        },
        {
            "introduced":  "6.0.3"
        },
        {
            "last_affected":  "6.0.3"
        },
        {
            "introduced":  "6.0.4"
        },
        {
            "last_affected":  "6.0.4"
        },
        {
            "introduced":  "6.0.5"
        },
        {
            "last_affected":  "6.0.5"
        },
        {
            "introduced":  "6.0.6"
        },
        {
            "last_affected":  "6.0.6"
        },
        {
            "introduced":  "6.0.7"
        },
        {
            "last_affected":  "6.0.7"
        },
        {
            "introduced":  "6.1.0"
        },
        {
            "last_affected":  "6.1.0"
        },
        {
            "introduced":  "6.1.1"
        },
        {
            "last_affected":  "6.1.1"
        },
        {
            "introduced":  "6.1.2"
        },
        {
            "last_affected":  "6.1.2"
        },
        {
            "introduced":  "6.1.3"
        },
        {
            "last_affected":  "6.1.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.1.0
6.1.1
6.1.2
6.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108822.json"