Executive brief
Kamailio, an open-source SIP server used for VoIP platforms, contains a heap-based buffer overflow in its Diameter protocol handler. A remote attacker can send a malformed Diameter message to trigger the overflow, potentially leading to code execution or service disruption. The vulnerability affects multiple recent versions and a patch is available.
Technical details
A heap-based buffer overflow exists in the shm_malloc function within src/modules/cdp/receiver.c of the CDP Diameter Receiver component. The vulnerability occurs when processing undersized Diameter messages: the code copies a 20-byte header without validating that the declared message length matches the allocated buffer size, allowing heap corruption. The attack is remotely triggerable over the network and does not require authentication.
Affected products
- Kamailio Kamailio up to 5.8.8, 6.0.x before 6.0.8, 6.1.x before 6.1.5, 6.2.0-dev1
Timeline
- 2026-09-20: disclosed: Vulnerability disclosed and exploit made public
- 2026-09-20: patched: Fix available in commits 38711a3e788de0130d48cb485578c482b57d9351 and related patches; upgrade to 6.0.8 or later