Use-after-free in pjsip - #VU155805
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory or cause a denial of service.
The vulnerability exists due to use-after-free in the PJLIB-UTIL HTTP client functions http_on_data_read() and restart_req_with_auth() when an application destroys a request from its callbacks and the client continues using it. A remote attacker can return an HTTP 401 or 407 response that triggers an authenticated retry which fails to start to corrupt memory or cause a denial of service.
The server-response attack requires configured authentication credentials. An on-path adversary can also trigger this scenario over a plain HTTP connection. Only applications using the pj_http_req_* API directly are affected; PJSUA and PJSUA2 do not use this HTTP client.