CVE-2020-27507
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and...
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
CVE-2020-27507- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
CVE-2020-27507- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2020-20017
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
EUVD-2020-20017- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q52j-c5xj-88qf
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and...
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
GHSA-q52j-c5xj-88qf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
CVE-2020-27507- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-27507
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
DEBIAN-CVE-2020-27507- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27507
The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact.
- Record
UBUNTU-CVE-2020-27507- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6022-1 No score
kamailio vulnerabilities
It was discovered that Kamailio did not properly sanitize SIP messages under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and 18.04 ESM. (CVE-2018-16657)
It was discovered that Kamailio did not properly validate INVITE requests under certain circumstances. An attacker could use this vulnerability to cause a denial of service or possibly execute arbitrary code. (CVE-2020-27507)
- Record
USN-6022-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kamailioDebian:12 |
before 5.4.2-1 | 5.4.2-1 |
kamailioDebian:13 |
before 5.4.2-1 | 5.4.2-1 |
kamailioDebian:14 |
before 5.4.2-1 | 5.4.2-1 |
kamailioDebian:10 |
before 5.2.1-1+deb10u1, plus listed versions 5.2.1-1 |
5.2.1-1+deb10u1 |
kamailioUbuntu:Pro:16.04:LTS |
before 4.3.4-1.1ubuntu2.1+esm1, plus listed versions 4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.1 |
4.3.4-1.1ubuntu2.1+esm1 |
kamailioUbuntu:Pro:18.04:LTS |
before 5.1.2-1ubuntu2+esm1, plus listed versions 4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu2 |
5.1.2-1ubuntu2+esm1 |
kamailioUbuntu:Pro:20.04:LTS |
before 5.3.2-1ubuntu0.1~esm1, plus listed versions 5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build15.3.2-1build25.3.2-1build3 |
5.3.2-1ubuntu0.1~esm1 |
kamailioUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 4.3.4-1.1ubuntu2.1+esm1, plus listed versions 4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.1 |
4.3.4-1.1ubuntu2.1+esm1 |
kamailioUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 5.1.2-1ubuntu2+esm1, plus listed versions 4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu2 |
5.1.2-1ubuntu2+esm1 |
kamailioUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 5.3.2-1ubuntu0.1~esm1, plus listed versions 5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build15.3.2-1build25.3.2-1build3 |
5.3.2-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27507 is a critical vulnerability (CVSS 9.8) in Kamailio, published March 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in kamailio 5.4.2-1.
References
github.com/kamailio/kamailio/issues/2503
lists.debian.org/debian-lts-announce/2023/05/msg00030.html
nvd.nist.gov/vuln/detail/CVE-2020-27507
security-tracker.debian.org/tracker/CVE-2020-27507