Threat Intelligence Report: CVE-2026-52022

Executive Summary

CVE-2026-52022 is a denial-of-service (DoS) vulnerability affecting Kamailio SIP server versions 6.1.1 and earlier, specifically within the IMS (IP Multimedia Subsystem) P-CSCF (Proxy-Call Session Control Function) registration handling components. A remote, unauthenticated attacker can exploit this flaw to crash or severely degrade the availability of affected Kamailio instances, making it a High-severity (CVSS 7.5) availability-impacting vulnerability with network-based attack vector and no user interaction or privileges required.

The vulnerability is of particular concern to telecommunications operators and service providers that deploy Kamailio as an IMS core component, since P-CSCF is the first point of contact for user equipment (UE) in an IMS network. Given that a public PoC/exploit reference exists, and with EPSS score of 0.00332 (25.9th percentile), active exploitation is not currently widespread but the public availability of exploit material elevates near-term risk. Patch confidence is rated 3/4 (LIKELY), with two independent sources (NVD and OSV) confirming the availability of a fix. Organizations running affected versions should prioritize upgrading to patched releases.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2026-52022 is classified under CWE-400 (Uncontrolled Resource Consumption), a vulnerability class that encompasses resource exhaustion scenarios such as memory leaks, CPU saturation, file descriptor exhaustion, or unbounded queue growth. The NVD description identifies the vulnerable component as the IMS P-CSCF registration handling portions of Kamailio, indicating that the flaw resides in the logic that processes registration requests (REGISTER SIP messages) from IMS user equipment.

The IMS P-CSCF module in Kamailio is responsible for:

• Receiving initial SIP REGISTER requests from UE devices
• Forwarding registrations to the I-CSCF (Interrogating-CSCF) for authentication and location discovery
• Maintaining registration state and binding information
• Handling re-registration and de-registration flows

The attack mechanism is consistent with a resource exhaustion flaw in the REGISTER processing pathway. When the module fails to properly bound or validate certain attributes of inbound registration requests—such as the rate of requests, the size of registrar bindings, or the number of concurrent registration sessions—an attacker can send a crafted sequence (or volume) of SIP REGISTER messages that causes the server to exhaust available memory, file descriptors, or processing capacity, triggering a crash or hang of the affected process.

Because the vulnerability is in registration handling, the attack surface is the SIP signaling interface—typically UDP/TCP port 5060 (and TLS on 5061) where Kamailio listens for inbound SIP traffic.

Attack Surface

The IMS P-CSCF functionality is typically deployed in a front-end position in IMS networks, directly facing the radio access network via the Gm reference point between UE and P-CSCF. In many deployments, P-CSCF nodes are reachable from less-trusted network segments than core IMS components, making this a significantly exposed attack surface. Even where the P-CSCF sits behind a border gateway (e.g., an IBCF/TrGW), the registration entry point is commonly accessible from the operator's public or semi-public network domain.

Kamailio is frequently deployed in production-grade carrier environments as a SIP proxy/registrar given its modular architecture and high throughput characteristics. This makes the impact of a remotely-triggered crash significant: a crash in the IMS P-CSCF component denies all subscribers registered to that node their IMS services (VoLTE, VoNR, RCS messaging, etc.).

Insufficient Technical Detail Available

The NVD description provided does not identify the precise code path, function name(s), or configuration parameter(s) at fault. Flags, module function names, or specific configuration directives are not listed. Enterprises should note that insufficient technical detail is available in the public disclosure to pinpoint the exact vulnerable function inside the IMS P-CSCF registration handling code. The fix is confirmed present in versions released after 6.1.1, with patching identified as the primary remediation path.

Exploitation Scenarios

Note: The following is based on the vulnerability class (CWE-400 — uncontrolled resource consumption) and the affected component (IMS P-CSCF registration handling). No public PoC or code-level exploit is currently described in public NVD data. Attack chain is inferred from the vulnerability class.

Step 1: Reconnaissance / Target Identification

An attacker begins by identifying Kamailio IMS P-CSCF nodes. Discovery techniques include:

• SIP OPTIONS scanning: Sending SIP OPTIONS requests to discover SIP-speaking hosts on UDP/TCP port 5060/5061
• Banner grabbing: Kamailio's SIP User-Agent header (e.g., "Kamailio/6.1.1") reveals version information
• Shodan/Censys: Internet-accessible SIP servers are indexed using filters such as product:"Kamailio" or port:"5060"
• DNS enumeration: For IMS nodes, SRV records for _sip._udp.<operator-domain> can reveal P-CSCF addresses

Targets are prioritized where the version banner indicates 6.1.1 or earlier.

Step 2: Triggering the Vulnerability

The attacker crafts SIP REGISTER requests targeting the P-CSCF registration handler. Given the CWE-400 classification, the exploitation likely involves one of the following patterns:

Pattern A — Request Flooding: A high-volume burst of REGISTER messages designed to exhaust per-registration memory pools or transaction state tables. The P-CSCF registrar must maintain transaction state and registration bindings; if the handling code fails to impose or enforce rate limits or connection caps, memory exhaustion occurs.

Pattern B — Malformed Tailored Requests: A smaller number of crafted REGISTER messages containing edge-case values in headers that the IMS-specific parser handles inefficiently (e.g., non-conformant P-Access-Network-Info headers, malformed Authorization headers with IMS-AKA challenge parameters, overly long contact URIs, or improperly formatted Security-Client / Security-Verify headers which are key IMS security negotiation fields).

Pattern C — State Toggle Pathological Input: Requests exploiting boundary conditions between registration and re-registration, specifically triggering code paths that manage the IMS security context or the registration expiry timers in a way that causes uncontrolled memory consumption per session before cleanup.

Since the NVD description does not single out one of these paths, all should be considered plausible at the class level.

Step 3: Payload / Execution Method

At the vulnerability-class level, the "payload" is not arbitrary code — this is a pure availability impact (CVE vector shows C:N/I:N/A:H). The attacker does not achieve code execution, privilege escalation, or data exfiltration. The payload is instead an engineered sequence of SIP REGISTER messages, capitalizing on the resource consumption flaw in the P-CSCF registration routines.

Effective exploitation at scale could involve:

• Distributed botnet: SIP-scanning botnets (commonly seen in attacks against VoIP infrastructure) generate REGISTER floods from many source IPs
• Reflection/amplification: Though this vulnerability is CPU/memory exhaustion rather than bandwidth amplification, the attacker may use real UE-like registration flows to evade rate-limiting heuristics
• Targeting a single P-CSCF: Concentrating on one node's IP address to quickly trigger a crash before any failover loads

Step 4: Post-Exploitation Impact

When the P-CSCF process crashes or hangs:

• SIP signaling failure: All new REGISTER, RE-INVITE, and SUBSCRIBE requests through that node fail or time out
• Subscriber disruption: Active calls established through the P-CSCF may be dropped if the crash kills the process abruptly; idle registered UEs lose registration prior to re-registration timers
• Failover: In HA (high-availability) configurations with clustering, traffic may redirect to a standby node — but if the attack is an ongoing flood, the failover node may also fail, cascading to a full IMS outage

This is a single-node availability loss whose blast radius depends entirely on the network architecture. In telco operator networks without adequate over-provisioning and clustering, a single P-CSCF crash can leave a significant geographic region or rating-area without IMS services.

Impact Assessment

Severity and CVSS Interpretation

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High):

• AV:N: Remotely exploitable over the network — no adjacent-network access required
• AC:L: No special conditions needed
• PR:N: No authentication required — any reachable network client is a potential attacker
• UI:N: No victim interaction
• S:U: Impact confined to the vulnerable Kamailio service (no cross-scope data impact)
• A:H: High availability impact — the service can be rendered fully unavailable
• C:N/I:N: No confidentiality or integrity impact

Affected Systems

All Kamailio deployments version 6.1.1 and earlier running the IMS P-CSCF registration components are affected. Although the registration handling is IMS-specific, the module likely ships and is enabled by default in IMS personality builds. Risk is highest in:

• Telecom operators running VoLTE/VoNR cores
• IMS application servers (AS) deployed behind P-CSCF
• Enterprises using Kamailio as an IMS-capable SBC/proxy
• Research/test labs building 5G core IMS prototypes

Blast Radius

Blast radius is gated by two factors: (1) reachability of the P-CSCF to the attacker, and (2) geographic/functional scope of registrations served by the affected instance. In an operator network, one P-CSCF node typically serves a percentage of the total subscriber base within a given region or pool — an outage disables IMS services (calls, RCS, VoLTE) for the subscribers homed on that node.

EPSS Valuation

The EPSS score of 0.00332 (25.9th percentile) places this below the median likelihood of exploitation in the wild within the next 30 days. Combined with CISA KEV status NOT flagged, this indicates no confirmed in-the-wild exploitation as of the report date. However, the public PoC availability is the principal near-term risk driver — a public exploit lowers the skill barrier, and the EPSS percentile is expected to rise after CVE dissemination reaches the security community.

Detection Guidance

The following rules are designed to detect traffic patterns consistent with exploitation of CWE-400 resource-exhaustion in SIP registration paths.

Sigma Rule

title: Kamailio IMS P-CSCF SIP REGISTER Flood - DoS Attempt
id: 3f1c5c8e-d4a7-4b2e-9e21-c5e6a7f9b008
status: experimental
description: Detects high-volume SIP REGISTER message sequences sent to Kamailio IMS P-CSCF, potentially triggering CVE-2026-52022 (uncontrolled resource consumption)
logsource:
  category: network_connection
  product: suricata
  service: sip
detection:
  selection:
    event_type: sip
    sip.request_method: REGISTER
  timeframe: 5s
  condition: selection | count() by src_ip > 100
  filter_friendly_scanner:
    src_ip:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection and not filter_friendly_scanner
level: medium
falsepositives:
  - Legitimate SIP registration bursts during network reconfigurations
  - Large multi-UE home networks with centralized NAT egress
tags:
  - attack.t1190
  - cve.2026-52022
  - cwe.400

YARA Rule

rule SIP_REGISTER_Abnormal_Header_Volume_CVE_2026_52022 {
    meta:
        author      = "Valtersit Threat Intel"
        description = "Detect SIP REGISTER messages with anomalous header distribution patterns consistent with IMS P-CSCF resource-exhaustion attempts (CVE-2026-52022)"
        date        = "2026-02-15"
        severity    = "high"
        reference   = "CVE-2026-52022"
    strings:
        $m_reg = "REGISTER sip:" ascii nocase
        $h_contact = "Contact:" ascii nocase
        $h_auth = "Authorization:" ascii nocase
        $h_pani = "P-Access-Network-Info:" ascii nocase
        $h_sc = "Security-Client:" ascii nocase
        $h_via = "Via:" ascii nocase
        $s_cseq_reg = "CSeq: " ascii
    condition:
        uint16(0) == 0x3A53 // SIP payload - start of SIP text after IP/UDP headers decode
        and any of ($m_reg)
        and all of ($h_*)
        and #h_contact > 3 and #h_auth > 3 and #h_pani > 3
        and filesize > 5000
}

Suricata IDS Rule

alert sip any any -> $HOME_NET 5060 (msg:"KAMAILIO IMS P-CSCF REGISTER flood attempt (CVE-2026-52022)"; flow:to_server; sip.method:REGISTER; threshold:type both, track by_src, count 100, seconds 5; classtype:attempted-dos; sid:5202201; rev:1; reference:cve,2026-52022;)

Elastic Detection

// Detect multi-REGISTER floods from a single source to a Kamailio IMS P-CSCF
sequence by destination.ip, source.ip with maxspan=5s
  [network where network.protocol == "sip" and event.action == "connection_established"]
  [network where network.protocol == "sip" and event.action == "connection_established"]
  [network where network.protocol == "sip" and event.action == "connection_established"]
  [network where network.protocol == "sip" and event.action == "connection_established"]
  [network where network.protocol == "sip" and event.action == "connection_established"]
  | stats reg_count = count() by source.ip, destination.ip
  | where reg_count >= 100

Splunk SPL Query

index=network sourcetype=sip
| where like(header_message, "REGISTER %")
| stats count as reg_attempts by src_ip, dest_ip, dest_port
| where reg_attempts > 100
| eval cve = "CVE-2026-52022", severity = "high"
| table _time, src_ip, dest_ip, dest_port, reg_attempts, cve, severity

Wazuh OSSEC Rule

<group name="sip_abuse,">
  <rule id="520220" level="12">
    <decoded_as>sip</decoded_as>
    <match>REGISTER</match>
    <field name="method">REGISTER</field>
    <frequency>100</frequency>
    <timeframe>5</timeframe>
    <same_source_ip/>
    <description>Kamailio IMS P-CSCF suspected DoS exploitation via REGISTER flood (CVE-2026-52022)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (NVD, OSV) confirm the fix.

1) Immediate Mitigations

Since no vendor-provided workaround is explicitly listed in the CVE data, the following interim controls are recommended:

• Deploy SIP-level rate limiting: Configure Kamailio's pike or ratelimit modules to throttle REGISTER request rates per source IP (e.g., max 50 REGISTER/5s per source)
• Enable SIP intrusion/reputation filtering: Use htable + siputils to blacklist sources that exceed REGISTER thresholds
• Access control rules: On network firewalls and SBCs, restrict SIP 5060/5061 access to trusted carrier IP ranges where feasible (use ACLs rather than full internet exposure)
• Upstream request validation: If an external SBC or Session Border Controller sits in front of the Kamailio P-CSCF, enable REGISTER rate limiting and caller validation there as the first line of defense
• Load balancer protection: If HAProxy or similar fronts the Kamailio P-CSCF, apply L7 SIP-aware request rate limiting and connection caps

2) Patch / Upgrade

• Upgrade to a patched version — the fix is present in versions after 6.1.1. Specifically, upgrade to the latest stable release (e.g., 6.1.2+ or current 6.2.x branch).
• Process:
  1. Review the Kamailio release notes for 6.1.2+ confirming CVE fix
  2. Validate configuration compatibility (config file changes may be required between minor versions)
  3. Deploy in a staging or canary environment and run a full REGISTER authentication test suite
  4. Roll out to production with capacity verification per node
• If running IMS-specific modules (e.g., ims_registrar_scscf or ims_ipsec_pcscf), confirm the patch addresses the IMS registration handler specifically

3) Long-term Hardening

• Regular patch cadence: Subscribe to Kamailio security announcements (security@kamailio.org) and maintain a sub-30-day vuln remediation SLA for network-adjacent SIP services
• Segment the P-CSCF layer: In IMS architecture, isolate P-CSCF nodes in a dedicated DMZ with only Gm-interface connectivity required; enforce access lists restricting which networks may reach the SIP signaling ports
• HA and failover architecture: Deploy at minimum N+1 redundancy of P-CSCF nodes with active health-checking and automatic fast-failover on process crash (systemd/watchdog or Kamailio's dispatcher module)
• Continuous detection: Deploy the Sigma/Suricata/SPL rules above to pre-empt full-scale exploitation attempts early in the attack chain
• Monitor upstream CISA KEV: While CVE-2026-52022 is not currently listed on CISA's Known Exploited Vulnerabilities catalog, periodic re-checks are advised as in-the-wild exploitation status may change

References

1. NVD Entry (Primary)
   https://nvd.nist.gov/vuln/detail/CVE-2026-52022

2. OSV Vulnerability Database
   https://osv.dev/vulnerability/CVE-2026-52022

3. Kamailio Official Site / Security
   https://www.kamailio.org/w/security-advisories/
   (Check for official advisory matching CVE-2026-52022)

4. CISA Known Exploited Vulnerabilities Catalog
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   (CVE-2026-52022 NOT currently listed)

5. EPSS (Exploit Prediction Scoring System)
   https://www.first.org/epss/
   (CVE-2026-52022 EPSS: 0.00332, 25.9th percentile)

Threat Actor & In-the-Wild Notes: No threat actor group has been publicly attributed to the exploitation of CVE-2026-52022. No evidence of in-the-wild exploitation has been reported in public sources as of writing. The public PoC/exploit reference, however, indicates capabilities documentation is available in the security research community — targeting an uptick in early opportunists probing IMS infrastructure is a reasonable near-term assumption. Enterprises with exposed P-CSCF nodes should treat this as a priority patch and monitor SIP REGISTER surges from anomalous sources.