CVE-2026-93962: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93962 is a heap-based buffer overflow vulnerability in Kamailio's CDP (Charging Data Proxy) Diameter Receiver module, specifically in the shm_malloc function within src/modules/cdp/receiver.c. It affects Kamailio versions up to and including 5.8.8, 6.0.7, 6.1.4, and 6.2.0-dev1. The flaw was reported on August 20, 2026, patched on August 21, 2026, and publicly disclosed on September 20, 2026. It carries a CVSS v3.1 base score of 8.3 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a missing lower-bound validation on the Diameter message-length field in do_receive() within src/modules/cdp/receiver.c (CWE-122: Heap-based Buffer Overflow; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The code validates the declared message length only against an upper bound (DP_MAX_MSG_LENGTH) but not against the minimum valid Diameter header size of 20 bytes (DIAMETER_HEADER_LEN). An attacker can open a TCP connection to any CDP-enabled Diameter interface (e.g., Cx/Rx/Gx/Ro/Gy/S6a on port 3869) and send a single 20-byte Diameter header with the message-length field set to a value less than 20 (e.g., 5). This causes shm_malloc(5) to allocate a 5-byte buffer, into which the full 20-byte header is then memcpy'd, resulting in a 15-byte heap overflow — exploitable before any capabilities exchange (CER/CEA) or authentication (GitHub Issue #4876, Patch Commit).

An unauthenticated remote attacker can trigger this vulnerability with a single malformed 20-byte packet, causing the CDP receiver process to crash (SIGABRT/denial of service), and potentially enabling arbitrary code execution by corrupting heap memory. The vulnerability affects all Diameter interfaces served by CDP (Cx, Rx, Gx, Ro, Gy, S6a, etc.), meaning IMS/VoLTE core network nodes such as I-CSCF, P-CSCF, and S-CSCF are at risk. Successful exploitation could result in loss of availability of the SIP/Diameter signaling infrastructure, unauthorized data access, or data modification, with a changed scope impacting components beyond the vulnerable module itself (GitHub Issue #4876, Feedly).

A proof-of-concept exploit has been publicly demonstrated and confirmed on live Kamailio 6.2.0-dev1 and 5.5.0 instances using a single crafted 20-byte TCP packet, with no authentication or prior peer provisioning required (GitHub Issue #4876). The CVSS v4.0 exploit maturity is rated "Proof of Concept" (E:P). The EPSS score is currently 0.0, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (Feedly). No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible Kamailio instances with the CDP module enabled (used in IMS/VoLTE deployments). Scan for open TCP port 3869 (standard Diameter port) using tools like Nmap or Shodan.
2. Establish TCP connection: Open a raw TCP connection to the target's Diameter port (e.g., nc <target> 3869 or a custom socket client), as no prior authentication or peer provisioning is required.
3. Craft malicious Diameter header: Construct a 20-byte Diameter header where bytes 1–3 (the Message Length field) are set to a value less than 20 (e.g., 0x000005 for length=5). Example payload (hex): 01 00 00 05 80 00 01 01 00 00 00 00 11 11 11 11 22 22 22 22.
4. Send the packet: Transmit the 20-byte packet over the TCP connection. The CDP receiver reads the declared length (5), calls shm_malloc(5), then memcpys the full 20-byte header into the 5-byte allocation, causing a 15-byte heap overflow.
5. Achieve impact: The overflow corrupts heap metadata, causing the CDP receiver process to abort (SIGABRT) and the Kamailio node to crash. With further heap-shaping, an attacker may be able to achieve arbitrary code execution (GitHub Issue #4876, Patch Commit).

• Network: Unexpected inbound TCP connections to Diameter port 3869 (or configured CDP port) from unknown or untrusted peers; single short packets (≤20 bytes) on Diameter TCP connections.
• Logs: Kamailio log entries such as CRITICAL: [core/mem/q_malloc.c]: qm_debug_check_frag(): BUG: qm: fragm. end overwritten; log lines referencing cdp: receiver.c in memory allocator error context; ALERT: handle_sigs(): child process exited by a signal 6 (SIGABRT).
• Process: Unexpected termination or restart of the Kamailio CDP child process; core dump files generated in the Kamailio working directory referencing receiver.c:621 or receiver.c:627.
• File System: Presence of core dump files (e.g., core.<pid>) in the Kamailio process directory following unexpected crashes (GitHub Issue #4876).

Upgrade Kamailio to version 6.0.8 or later, which includes the fix introduced by commit 38711a3 that adds a lower-bound check rejecting Diameter messages with a declared length below 20 bytes (Kamailio Release 6.0.8). For systems that cannot be patched immediately, restrict network access to CDP Diameter interfaces (port 3869) using firewall rules to allow only trusted, provisioned Diameter peers. Additionally, monitor for unexpected CDP process crashes and review firewall rules to minimize exposure of Kamailio services to untrusted networks (Feedly).

The vulnerability was reported by a community contributor (GitHub user "Dongingop") via the Kamailio GitHub issue tracker on August 20, 2026, with detailed reproduction steps and live evidence logs. Kamailio maintainer henningw merged the fix the following day (August 21, 2026) and noted the patch should be backported to stable branches. The fix was included in the Kamailio 6.0.8 maintenance release, with deployments on previous 6.0.x versions "strongly recommended" to upgrade (GitHub Issue #4876, GitHub PR #4877, Kamailio Release 6.0.8).