CVE-2020-28361

MEDIUM

Kamailio < 5.4.0 - HTTP Request Smuggling via Whitespace Bypass in remove_hf Function

Title source: llm
STIX 2.1

Description

Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smuggling.html

Scores

CVSS v3 5.4
EPSS 0.0109
EPSS Percentile 61.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-444
Status published
Products (1)
kamailio/kamailio < 5.4.0
Published Nov 18, 2020
Tracked Since Feb 18, 2026