Race condition in pjsip - #VU156282
Published: October 21, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and corrupt DNS query results or cached records.
The vulnerability exists due to a race condition involving a shared response buffer in the DNS resolver's on_read_complete() function in pjlib-util/src/pjlib-util/resolver.c when processing responses concurrently on IPv4 and IPv6 sockets. A remote attacker can trigger overlapping DNS responses to overwrite a parsed response while it is being delivered to query callbacks or saved to the cache, potentially causing an invalid memory read, a crash, or delivery or caching of records from another, unvalidated response.
Affected applications must be built with PJ_HAS_IPV6 enabled and poll the resolver ioqueue from more than one thread.