SB2026080538 - Multiple vulnerabilities in pjsip

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080538

SB2026080538 - Multiple vulnerabilities in pjsip

Published: August 5, 2026 Updated: September 17, 2026

Security Bulletin ID SB2026080538
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 8% Medium 58% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denialo f service (DoS) attack.

The vulnerability exists due to a boundary error in pjmedia_h263_unpacketize() function. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.


2) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the pj_xml_parse() XML parser when parsing deeply nested XML documents in incoming SIP request bodies. A remote attacker can send a specially crafted SIP request with a deeply nested XML body to cause a denial of service.

The issue is reachable through XML bodies used by the presence/PIDF, dialog-info, and message-composition event packages, and production builds are affected because the existing recursion guard is only effective in debug builds.


3) Authentication Bypass by Spoofing (CVE-ID: N/A)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to spoof DNS responses and poison the DNS cache.

The vulnerability exists due to improper origin validation and use of insufficiently random values in the asynchronous DNS resolver when processing incoming DNS responses for pending queries. A remote attacker can send a forged DNS response to spoof DNS responses and poison the DNS cache.

A successful attack can poison SIP-related DNS lookups and redirect SIP signaling to an attacker-controlled host.


4) Algorithm Downgrade (CVE-ID: N/A)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to downgrade subsequent in-dialog requests to plaintext.

The vulnerability exists due to selection of less-secure transport during negotiation in the dialog layer target refresh handling in pjsip_dlg_on_rx_request() and pjsip_dlg_on_rx_response() in sip_dialog.c when processing a Contact URI from an in-dialog target refresh. A remote attacker can supply a non-sips Contact to downgrade subsequent in-dialog requests to plaintext.

Only applications using SIPS-secured dialogs are affected.


5) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the UPnP IGD client's download_igd_xml() function when processing a device description containing an empty serviceType element. A remote attacker can reply to an SSDP M-SEARCH request with a crafted device description to cause a denial of service.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.


6) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause the application to adopt a hostile IGD as its primary gateway.

The vulnerability exists due to a use-after-free in the UPnP IGD client's action_get_external_ip() function when processing a SOAP response containing an invalid NewExternalIPAddress value. A remote attacker can provide a crafted SOAP response to cause the application to adopt a hostile IGD as its primary gateway.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.


7) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the UPnP IGD client's action_get_external_ip() function when parsing a nonnumeric NewExternalIPAddress value from a SOAP response. A remote attacker can provide an attacker-chosen hostname as the address value to stall a libupnp worker thread during name resolution and cause a denial of service.

UPnP support must be built in and explicitly enabled for the vulnerable code path to be reachable.


8) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to unchecked return values in pjpidf_tuple_get_id() when parsing a malformed PIDF presence body containing a tuple without an id attribute. A remote user can send a malformed presence NOTIFY to cause a denial of service.

The sender must occupy the presentity or presence-server side of a presence subscription established by the application. Builds compiled with NDEBUG crash, while builds with assertions enabled abort.


9) Unchecked Return Value (CVE-ID: N/A)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to unchecked return values in pjpidf_tuple_get_status() when parsing a malformed PIDF presence body containing a tuple without a status child element. A remote user can send a malformed presence NOTIFY to cause a denial of service.

The sender must occupy the presentity or presence-server side of a presence subscription established by the application. Exploitation affects builds with assertions enabled, which is the default configuration.


10) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in calculate_response_expiration() in the SIP registration client when processing a 2xx response to an outgoing REGISTER containing a wildcard Contact header. A remote attacker can send a crafted 2xx response containing a wildcard Contact header to cause a denial of service.

The affected registration-client path is enabled by default.


11) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate a different host and observe or modify SIP signaling.

The vulnerability exists due to improper certificate common name extraction in the TLS backend certificate subject parsers when handling a peer TLS certificate during hostname verification. A remote attacker can present a certificate containing a CN= marker in an unrelated subject field to impersonate a different host and observe or modify SIP signaling.

Only TLS/SIPS transports with verify_server or verify_client set to PJ_TRUE are affected.


12) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate a different host and observe or modify SIP signaling.

The vulnerability exists due to improper validation of a certificate with a host mismatch in on_connect_complete() in the TLS transport when comparing a requested host name against certificate identities. A remote attacker can present a certificate whose SubjectAltName does not match the requested host name but whose Common Name does to impersonate a different host and observe or modify SIP signaling.

Only TLS/SIPS transports with verify_server or verify_client set to PJ_TRUE are affected.


Remediation

Install update from vendor's website.

References