CVE-2026-52023

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415 CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kamailio/kamailio/commit/722c06b3efc53ccb369ce812c685c7d069508187Patch
https://github.com/kamailio/kamailio/issues/4671Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Sep 1, 2026
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-52034.7A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib CVE-2026-52048.8A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the CVE-2026-52056.3A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib CVE-2026-52066.3A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the CVE-2026-52076.5The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. Thi CVE-2026-52087.2Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via inje CVE-2026-52092.4A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functional CVE-2026-520976.8An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), O CVE-2026-520989.8An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint CVE-2026-52107.3A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the CVE-2026-521007.5Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod CVE-2026-521019.1An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadR