Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an
    out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a
    denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts
    Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
    (CVE-2026-39863)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an     out-of-bounds access in the core of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a     denial of service (process crash) via a specially crafted data packet sent over TCP. The issue impacts     Kamailio instances having TCP or TLS listeners. This vulnerability is fixed in 5.1.1, 6.0.6, and 5.8.8.
    (CVE-2026-39863)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440438	Alpine: authephemeral, multiple kamailio packages: security update to 5.4.5-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
440438	Alpine: authephemeral, multiple kamailio packages: security update to 5.4.5-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
440102	Alpine: authephemeral, multiple kamailio packages: security update to 5.8.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
440102	Alpine: authephemeral, multiple kamailio packages: security update to 5.8.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
440101	Alpine: authephemeral, multiple kamailio packages: security update to 6.0.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
440101	Alpine: authephemeral, multiple kamailio packages: security update to 6.0.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
305796	Linux Distros Unpatched Vulnerability : CVE-2026-39863	Nessus	Misc.	high

Detections

Analytics

CVE-2026-39863

high

Tenable Plugins

high

high

high

high

high

high

high