SB2026092377 - Multiple vulnerabilities in Janus WebRTC Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092377

SB2026092377 - Multiple vulnerabilities in Janus WebRTC Server

Published: September 23, 2026

Security Bulletin ID SB2026092377
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 14% Medium 43% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the TextRoom message handler when processing a datachannel message containing a non-string element in the tos array. A remote user can send a crafted datachannel message containing a non-string tos array element to cause a denial of service.

The crash terminates the Janus process and drops all TextRoom rooms and users on the instance.


2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the videoroom create request handler when processing a create request containing an excessively large threads value. A remote user can submit a crafted create request to cause a denial of service.

The helper-thread creation loop holds rooms_mutex, blocking other videoroom operations while allocations are attempted.


3) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the Janus SIP and NoSIP plugins when handling peer messages that look up a destroyed session by its unique ID. A remote user can send ordinary peer messages referencing a stale unique ID to compromise confidentiality, integrity, and availability.

No race condition or admin API access is required.


4) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to an integer truncation resulting in a heap-based buffer overflow in janus_string_replace() in src/utils.c when processing SDP trickle candidates after mDNS or DNS resolution. A remote user can send a crafted trickle candidate containing an oversized candidate string to execute arbitrary code or cause a denial of service.

Exploitation depends on the transport accepting a candidate message larger than 64 KB and on the attacker answering the mDNS or DNS resolution.


5) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to send arbitrary commands to internal services.

The vulnerability exists due to improper URL protocol restriction in the Streaming plugin's RTSP mountpoint URL handling when processing API-supplied URLs. A remote attacker can supply a gopher URL through the plugin signaling API to send arbitrary commands to internal services.

Requests made through this vector are blind.


6) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to send arbitrary commands to internal services.

The vulnerability exists due to improper URL protocol restriction in the TextRoom plugin's room post and new_post URL handling when processing API-supplied URLs. A remote attacker can supply a gopher URL through the plugin signaling API to send arbitrary commands to internal services.

Requests made through this vector are blind, and the TextRoom plugin does not set a timeout for them.


7) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create or truncate files writable by Janus, including files in protected folders.

The vulnerability exists due to improper path restriction in AudioBridge recording file handling when processing record_file and record_dir values from plugin signalling API requests. A remote attacker can supply recording paths to create or truncate files writable by Janus.

Written data is limited to a fixed 44-byte RIFF header.


Remediation

Install update from vendor's website.

References