SB2026080389 - Multiple vulnerabilities in pjsip

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080389

SB2026080389 - Multiple vulnerabilities in pjsip

Published: August 3, 2026

Security Bulletin ID SB2026080389
CSH Severity
High
Patch available
NO
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 36% Medium 64%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the SIP message serializer when re-serializing received SIP messages containing a specially crafted multipart body. A remote attacker can send a specially crafted SIP message with an empty multipart body to disclose sensitive information or cause a denial of service.

Only applications that re-encode incoming multipart bodies, such as SIP proxies that forward requests, are affected.


2) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect media or signaling traffic and cause a denial of service.

The vulnerability exists due to improper authentication in the legacy simple STUN client when processing STUN Binding Responses for public-address discovery. A remote attacker can send a forged Binding Response to redirect media or signaling traffic and cause a denial of service.

Only applications that use a STUN server without ICE for public-address discovery are affected. Applications that use ICE for STUN, or that do not configure a STUN server, are not affected.


3) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate the target server and disclose sensitive information.

The vulnerability exists due to improper validation of certificate with host mismatch in the TLS server identity verification logic in the OpenSSL and GnuTLS backends when processing certificates with a DNS SubjectAltName containing an embedded NUL byte. A remote attacker can present a trusted certificate with a crafted embedded-NUL DNS SubjectAltName to impersonate the target server and disclose sensitive information.

Only applications using the PJSIP TLS or SIPS transport with server verification enabled are vulnerable, and mbedTLS-based deployments are not affected.


4) Stack-based buffer overflow (CVE-ID: CVE-2026-57166)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. A remote attacker can send an overly long command line to cause a denial of service.

Only applications that enable the telnet CLI front-end are vulnerable.


5) Stack-based buffer overflow (CVE-ID: CVE-2026-57165)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in the PJLIB-UTIL telnet CLI front-end history handling in handle_up_down() in cli_telnet.c when redrawing the command line during history recall. A remote attacker can access the unauthenticated telnet CLI and trigger history recall to cause a denial of service.

Only applications that enable the telnet CLI front-end are vulnerable.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-57164)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to heap-based buffer overflow in the PJLIB-UTIL HTTP client in http_client.c when buffering an HTTP response body. A remote attacker can send a crafted HTTP response with a malformed Content-Length value to cause memory corruption.

Only applications that receive the whole response body at once without using an incremental on_data_read callback are vulnerable. A malicious server or a man-in-the-middle position on the connection can trigger the issue.


7) Stack-based buffer overflow (CVE-ID: CVE-2026-57163)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in tls_cert_get_info() in ssl_sock_gtls.c when parsing the Subject Alternative Name extension of a peer certificate during the TLS handshake. A remote attacker can present a crafted certificate to execute arbitrary code or cause a denial of service.

Only builds using the GnuTLS backend are vulnerable, and the issue can be triggered before any SIP-level authentication.


8) Stack-based buffer overflow (CVE-ID: CVE-2026-57162)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in sdes_encode_sdp() in transport_srtp_sdes.c when processing a=crypto attributes during SDP offer/answer. A remote attacker can send a specially crafted SIP INVITE with excessive a=crypto attributes to execute arbitrary code.

Only applications with SRTP enabled using SDES keying are vulnerable, and the issue is reachable before application-level authentication during media negotiation.


9) Stack-based buffer overflow (CVE-ID: CVE-2026-57161)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in update_service_route() in pjsua_acc.c when processing Service-Route headers in a registration response. A remote attacker can send a specially crafted registration response with an excessive number of Service-Route headers to cause a denial of service.

The issue affects applications that use the PJSUA/PJSUA2 account API for registration, and the malicious response may originate from a compromised or malicious registrar or from a spoofed response over unprotected transports.


10) Off-by-one (CVE-ID: CVE-2026-57160)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an off-by-one error in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c when serializing generic array headers while re-serializing incoming SIP requests. A remote attacker can send a specially crafted SIP request to cause a denial of service.

This is primarily reachable in applications such as proxies, SBCs, or B2BUAs that parse and re-serialize incoming SIP messages.


11) Out-of-bounds write (CVE-ID: CVE-2026-57159)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption and a denial of service.

The vulnerability exists due to out-of-bounds write in assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c when processing a crafted remote SDP offer or answer. A remote attacker can send a specially crafted remote SDP offer or answer to cause memory corruption and a denial of service.

Only instances with the PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP feature enabled are vulnerable.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References