{"id":"CVE-2020-28361","aliases":["DEBIAN-CVE-2020-28361","EUVD-2020-20821","GHSA-qw54-9qj3-wxh7","UBUNTU-CVE-2020-28361","USN-7416-1"],"status":"published","title":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2...","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01108,"percentile":0.66147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2020-11-18T13:34:23Z","modified":"2026-10-26T12:00:26Z","fixes":[{"ecosystem":"Debian:12","package":"kamailio","fixed_in":["5.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kamailio","fixed_in":["5.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kamailio","fixed_in":["5.4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","fixed_in":["5.1.2-1ubuntu2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"kamailio","fixed_in":["5.3.2-1ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-2ubuntu1","4.3.4-1.1ubuntu1","4.3.4-1.1ubuntu2","4.3.4-1.1ubuntu2.1","4.3.4-1.1ubuntu2.1+esm1","4.3.4-1.1ubuntu2.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1ubuntu2+esm2"}]}],"versions":["4.4.2-3ubuntu5","5.0.4-1ubuntu1","5.1.1-1ubuntu1","5.1.1-1ubuntu4","5.1.2-1ubuntu1","5.1.2-1ubuntu2","5.1.2-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-1ubuntu0.1~esm2"}]}],"versions":["5.2.3-1build3","5.2.3-1build4","5.3.0-2","5.3.1-1","5.3.2-1build1","5.3.2-1build2","5.3.2-1build3","5.3.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.1ubuntu2.1+esm2"}]}],"versions":["4.3.1-2ubuntu1","4.3.4-1.1ubuntu1","4.3.4-1.1ubuntu2","4.3.4-1.1ubuntu2.1","4.3.4-1.1ubuntu2.1+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-1ubuntu2+esm2"}]}],"versions":["4.4.2-3ubuntu5","5.0.4-1ubuntu1","5.1.1-1ubuntu1","5.1.1-1ubuntu4","5.1.2-1ubuntu1","5.1.2-1ubuntu2","5.1.2-1ubuntu2+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"kamailio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-1ubuntu0.1~esm2"}]}],"versions":["5.2.3-1build3","5.2.3-1build4","5.3.0-2","5.3.1-1","5.3.2-1build1","5.3.2-1build2","5.3.2-1build3","5.3.2-1ubuntu0.1~esm1"],"bundled":3}],"products":[{"vendor":"kamailio","product":"kamailio"}],"references":[{"url":"https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smuggling.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","report"]},{"url":"https://support.sippysoft.com/support/discussions/topics/3000179616","tags":["x_refsource_MISC","x_transferred","Permissions Required","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28361"},{"url":"https://github.com/advisories/GHSA-qw54-9qj3-wxh7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28361","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28361","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28361","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7416-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14767","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28361","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T13:34:23Z","modified":"2024-08-04T16:33:59.139Z","updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2020-20821","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T13:34:23Z","modified":"2024-08-04T16:33:59Z","updated_at":"2026-11-03T03:07:10.123634Z"}],"ghsa":[{"id":"GHSA-qw54-9qj3-wxh7","title":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2...","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module.","status":"published","published":"2022-05-24T17:34:32Z","modified":"2023-01-29T05:04:45Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:45:37.901426Z"}],"nvd":[{"id":"CVE-2020-28361","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T14:15:12.017Z","modified":"2026-06-17T03:10:19.77Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"CVE-2020-28361","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T14:15:12.017Z","modified":"2026-10-24T10:30:58.502006193Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-28361","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T14:15:12.017Z","modified":"2026-10-26T12:00:26.450326395Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-28361","description":"Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.","status":"published","published":"2020-11-18T14:15:00Z","modified":"2026-02-04T03:05:31.747329Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"USN-7416-1","title":"kamailio vulnerabilities","description":"Stelios Tsampas discovered that Kamailio did not correctly handle certain\nmemory operations, which could lead to a buffer overflow. A remote attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2385)\n\nHenning Westerholt discovered that Kamailio did not correctly handle\nduplicated headers, which could lead to a segmentation fault. A remote\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2018-14767)\n\nIt was discovered that Kamailio did not correctly handle parsing certain\nheaders containing whitespace characters. An authenticated attacker could\npossibly use this issue to gain access to unauthorized resources and\nexpose sensitive information. This issue only affected Ubuntu 18.04 LTS\nand Ubuntu 20.04 LTS. (CVE-2020-28361)\n","status":"published","published":"2025-04-07T01:35:36Z","modified":"2026-06-25T13:32:30.276515707Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}