CVE-2026-57164
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.
Risk Assessment
A malicious or man-in-the-middle HTTP server can cause application crashes or memory corruption, potentially leading to denial of service or code execution.
Recommendation
Upgrade PJSIP to a version containing commit 8d5956a, which fixes this vulnerability.
Other vulnerabilities in PJSIP
See all- CVE-2022-24763High
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps.
- CVE-2026-34235Critical
PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.
- CVE-2022-39269Critical
PJSIP is a free and open source multimedia communication library that may incorrectly switch from using SRTP media transport to basic RTP upon SRTP restart. This leads to media being sent insecurely.
- CVE-2026-57165Medium
In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.
- CVE-2026-57163High
PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.
- CVE-2026-57162High
PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57161High
PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.
- CVE-2026-57160Medium
In the PJSIP library before commit d6a0e7f, there is a buffer overflow in pjsip_generic_array_hdr_print() in sip_msg.c, which serializes generic array headers (e.g., Allow, Require, Supported). Under certain output-buffer boundary conditions, the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests, such as proxies, SBCs, or B2BUAs.
- CVE-2026-57159High
PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.
Original NVD description (English source)
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response; impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally (via on_data_read), or that only connect to trusted servers, are not affected. This issue has been patched via commit 8d5956a.