A security vulnerability is when a user of Kamailio can cause Kamailio to crash or lock up by sending messages to the server process.
If you believe there's a security vulnerability, please don't use the public forums. Send e-mail to firstname.lastname@example.org and the issue will be handled properly.
Kamailio will publish security vulnerabilities, including an CVE ID, on the kamailio-announce mailing list, sr-users as well as related lists. The advisories will also be published on the kamailio.org web site.
A Kamailio Security team should be appointed with core developers of the project. These individuals will be part of the security process and review patches and text for the vulnerability report. Two persons should take the role of Kamailio Security Officers. One of these should manage each security incident - which does not mean solving the code issue, but managing the process from report to publication and patch release.
This address should have a PGP key associated, used by the security officers.