CVE-2020-28361
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2...
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
CVE-2020-28361- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
CVE List No score
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
CVE-2020-28361- Updated
- 2026-11-02
EUVDEUVD-2020-20821 No score
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
EUVD-2020-20821- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qw54-9qj3-wxh7 No score
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2...
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module.
- Record
GHSA-qw54-9qj3-wxh7- Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
CVE-2020-28361- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-28361
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
DEBIAN-CVE-2020-28361- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-28361
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
- Record
UBUNTU-CVE-2020-28361- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-7416-1 No score
kamailio vulnerabilities
Stelios Tsampas discovered that Kamailio did not correctly handle certain memory operations, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2385)
Henning Westerholt discovered that Kamailio did not correctly handle duplicated headers, which could lead to a segmentation fault. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-14767)
It was discovered that Kamailio did not correctly handle parsing certain headers containing whitespace characters. An authenticated attacker could possibly use this issue to gain access to unauthorized resources and expose sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28361)
- Record
USN-7416-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kamailioDebian:12 |
before 5.4.0-1 | 5.4.0-1 |
kamailioDebian:13 |
before 5.4.0-1 | 5.4.0-1 |
kamailioDebian:14 |
before 5.4.0-1 | 5.4.0-1 |
kamailioUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.14.3.4-1.1ubuntu2.1+esm14.3.4-1.1ubuntu2.1+esm2 |
None known |
kamailioUbuntu:Pro:18.04:LTS |
before 5.1.2-1ubuntu2+esm2, plus listed versions 4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu25.1.2-1ubuntu2+esm1 |
5.1.2-1ubuntu2+esm2 |
kamailioUbuntu:Pro:20.04:LTS |
before 5.3.2-1ubuntu0.1~esm2, plus listed versions 5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build15.3.2-1build25.3.2-1build35.3.2-1ubuntu0.1~esm1 |
5.3.2-1ubuntu0.1~esm2 |
kamailioUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 4.3.4-1.1ubuntu2.1+esm2, plus listed versions 4.3.1-2ubuntu14.3.4-1.1ubuntu14.3.4-1.1ubuntu24.3.4-1.1ubuntu2.14.3.4-1.1ubuntu2.1+esm1 |
4.3.4-1.1ubuntu2.1+esm2 |
kamailioUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 5.1.2-1ubuntu2+esm2, plus listed versions 4.4.2-3ubuntu55.0.4-1ubuntu15.1.1-1ubuntu15.1.1-1ubuntu45.1.2-1ubuntu15.1.2-1ubuntu25.1.2-1ubuntu2+esm1 |
5.1.2-1ubuntu2+esm2 |
kamailioUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 5.3.2-1ubuntu0.1~esm2, plus listed versions 5.2.3-1build35.2.3-1build45.3.0-25.3.1-15.3.2-1build15.3.2-1build25.3.2-1build35.3.2-1ubuntu0.1~esm1 |
5.3.2-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-28361 is a medium vulnerability (CVSS 5.4) in Kamailio, published November 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in kamailio 5.4.0-1.