| Title | Kamailio Kamailio SIP Server 6.1.4 Heap-based Buffer Overflow |
|---|
| Description | Kamailio SIP Server 6.1.4 is affected by a remotely triggerable heap-based buffer overflow in the CDP Diameter receiver in src/modules/cdp/receiver.c. The Diameter Message Length field is validated against the upper limit DP_MAX_MSG_LENGTH, but no lower-bound validation is performed to ensure that the declared message length is at least the 20-byte Diameter header size. An unauthenticated remote TCP peer can send a single 20-byte Diameter header whose Message Length field declares a value below 20, for example 5. The CDP receiver then allocates a shared-memory buffer using shm_malloc() with the attacker-controlled declared length and subsequently copies the complete 20-byte Diameter header into that smaller allocation with memcpy(), resulting in a heap buffer overflow. The vulnerability is reachable before CER/CEA capability exchange and before application-level authentication, and does not require the remote host to be configured as an authorized Diameter peer. Testing against 6.2.0-dev1 with memory debugging enabled demonstrated attacker-controlled heap corruption followed by SIGABRT and termination of the Kamailio node. The issue was also confirmed on Kamailio 5.5.0, and the same vulnerable receive logic is present in the 5.8.8, 6.0.7, and 6.1.4 release sources. The vulnerability was publicly reported to the Kamailio project in GitHub issue #4876. The project acknowledged the report and merged a fix in commit 38711a3e788de0130d48cb485578c482b57d9351 through pull request #4877, adding the missing lower-bound validation before allocation. No public CVE identifier is known for this specific vulnerability at the time of submission. |
|---|
| Source | ⚠️ https://github.com/kamailio/kamailio/issues/4876 |
|---|
| User | WeiYi (UID 96864) |
|---|
| Submission | 08/23/2026 17:21 (27 days ago) |
|---|
| Moderation | 09/19/2026 11:23 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 407921 [Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1 CDP Diameter Receiver receiver.c shm_malloc heap-based overflow] |
|---|
| Points | 20 |
|---|