CVE-2026-93962: Kamailio CDP Receiver Buffer Overflow

CVE-2026-93962 Overview

CVE-2026-93962 is a heap-based buffer overflow in Kamailio, the open-source SIP server widely deployed in VoIP and telecommunications infrastructure. The flaw resides in the shm_malloc handling within src/modules/cdp/receiver.c, which is part of the CDP (C Diameter Peer) Diameter Receiver component. A remote attacker can trigger the overflow by sending a malformed Diameter message whose declared length is smaller than the Diameter header itself. The vulnerability affects Kamailio versions up to and including 5.8.8, 6.0.7, 6.1.4, and 6.2.0-dev1. Public exploit details are available, increasing the likelihood of opportunistic exploitation against exposed Diameter interfaces.

Critical Impact
Remote attackers can send undersized Diameter messages to trigger a heap-based buffer overflow in the CDP receiver, potentially causing service disruption or memory corruption in Kamailio SIP servers.

Affected Products

Kamailio versions up to and including 5.8.8
Kamailio versions up to and including 6.0.7
Kamailio versions up to and including 6.1.4 and 6.2.0-dev1

Discovery Timeline

2026-09-20 - CVE-2026-93962 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93962

Vulnerability Analysis

The vulnerability is a classic heap-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It resides in the Diameter receiver loop of Kamailio's CDP module, which parses incoming Diameter messages over TCP or SCTP. The receiver reads the 20-byte Diameter header and extracts a 3-byte length field indicating the total message size. The code then uses this attacker-controlled length to allocate and populate a shared-memory buffer via shm_malloc.

Before the patch, the receiver validated that the declared length did not exceed DP_MAX_MSG_LENGTH but never validated the lower bound. Supplying a length smaller than DIAMETER_HEADER_LEN (20 bytes) causes subsequent buffer arithmetic to operate on an undersized allocation, leading to heap corruption when body bytes are copied. Public exploitation guidance is already available.

Root Cause

The root cause is missing lower-bound validation of the length field parsed from an untrusted Diameter header. The receiver trusted attacker-supplied length values as long as they did not exceed the maximum, which permitted the receiver state machine to advance into a corrupt read state.

Attack Vector

Exploitation requires network reach to a Kamailio instance with the CDP module active and a Diameter peer socket exposed. No authentication or user interaction is required. An attacker connects to the Diameter port and sends a crafted message whose header length field is set below 20 bytes.

			sp->buf_len += cnt;
			if(sp->buf_len == DIAMETER_HEADER_LEN) {
				sp->length = get_3bytes(sp->buf + 1);
+				if(sp->length < DIAMETER_HEADER_LEN) {
+					LM_ERR("[%.*s] Msg too short [%d] bytes\n",
+							sp->p ? sp->p->fqdn.len : 0,
+							sp->p ? sp->p->fqdn.s : 0, sp->length);
+					goto error_and_reset;
+				}
				if(sp->length > DP_MAX_MSG_LENGTH) {
					LM_ERR("[%.*s] Msg too big [%d] bytes\n",
							sp->p ? sp->p->fqdn.len : 0,

Source: Kamailio Commit 38711a3e. The patch adds a lower-bound check that rejects any Diameter message whose declared length is smaller than the fixed header size.

Detection Methods for CVE-2026-93962

Indicators of Compromise

Kamailio log entries containing Msg too short errors from the CDP receiver, indicating either exploitation attempts or scanning activity against patched instances.
Unexpected Kamailio worker process crashes, restarts, or segmentation faults tied to the CDP module.
Inbound TCP or SCTP connections to Diameter ports (typically 3868) from unknown or non-peer source addresses.

Detection Strategies

Inspect Diameter traffic at the network layer for messages whose header length field is less than 20 bytes and generate alerts on those anomalies.
Monitor Kamailio LM_ERR output for the newly added short-message rejection logs to identify probing activity.
Correlate CDP receiver errors with peer FQDN fields to identify which upstream Diameter peer or attacker source is sending malformed messages.

Monitoring Recommendations

Enable verbose logging for the CDP module and forward logs to a centralized SIEM for correlation.
Track process stability metrics for kamailio workers and alert on crash loops or abnormal restart frequency.
Baseline expected Diameter peer source addresses and alert on connections from any address outside that allowlist.

How to Mitigate CVE-2026-93962

Immediate Actions Required

Upgrade Kamailio to version 6.0.8 or later, which contains the fix commit 38711a3e788de0130d48cb485578c482b57d9351.
Restrict network access to Diameter ports so only trusted peer IP addresses can reach the CDP receiver socket.
Review Kamailio logs and process history for prior crashes or short-message errors that may indicate historical exploitation attempts.

Patch Information

The Kamailio project released version 6.0.8, which resolves this issue. Details are available in the Kamailio Release 6.0.8, the Kamailio Commit Update, the Kamailio Pull Request, and the Kamailio Issue Discussion.

Workarounds

Disable the CDP Diameter module if it is not required for the deployment's SIP signaling workload.
Place a network filter or reverse proxy in front of the Diameter interface that validates minimum Diameter header length before forwarding traffic.
Enforce strict firewall ACLs limiting Diameter port exposure to known peer endpoints only.

bash

# Verify installed Kamailio version and upgrade to 6.0.8 or later
kamailio -V

# Example iptables rule limiting Diameter (TCP/3868) to a trusted peer
iptables -A INPUT -p tcp --dport 3868 -s 203.0.113.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 3868 -j DROP