Improper validation of certificate with host mismatch in pjsip - CVE-2026-84975

Vulnerability details

The vulnerability allows a remote attacker to impersonate the target server and disclose sensitive information.

The vulnerability exists due to improper validation of certificate with host mismatch in the TLS server identity verification logic in the OpenSSL and GnuTLS backends when processing certificates with a DNS SubjectAltName containing an embedded NUL byte. A remote attacker can present a trusted certificate with a crafted embedded-NUL DNS SubjectAltName to impersonate the target server and disclose sensitive information.

Only applications using the PJSIP TLS or SIPS transport with server verification enabled are vulnerable, and mbedTLS-based deployments are not affected.

Affected software

How to mitigate CVE-2026-84975

External References

• https://github.com/pjsip/pjproject/security/advisories/GHSA-382p-87mh-r3q8
• https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd

Related Security Bulletins

• Multiple vulnerabilities in pjsip
• Fedora 45 update for asterisk