CVE-2026-93962: Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shmmalloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kamailio (CDP Diameter Receiver)to a version that resolves this vulnerability.Fixed in 6.0.8Patch 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Kamailio deployments using the CDP Diameter Receiver component are affected when running versions up to 5.8.8, 6.0.7, 6.1.4, or 6.2.0-dev1. The issue can be exploited remotely.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access with low complexity, no privileges required, and no user interaction.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been made public and could be used in attacks.
What is the available remediation?
Upgrade the affected component to Kamailio version 6.0.8. The listed fixes are commits 38711a3e788de0130d48cb485578c482b57d9351 and 4f62235b6f477b649c5cc18b0c81b4e26c949b98.