CVE-2026-41415
published 2026-04-24CVE-2026-41415: PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed…
PriorityP347critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.31%
22.4th percentile
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pjsip | pjproject | < 2.17 | 2.17 |
| teluu | pjsip | < 2.17 | 2.17 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv4.06.7MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
vendor_redhat·2026-04-24·CVSS 6.7
CVE-2026-41415 [MEDIUM] CWE-125 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
A flaw was found in PJSIP, a multimedia communication library. A remote attacker could exploit this vulnerability by sending a specially crafted Session Initiation Protocol (SIP) multipart message containing a malformed Content-ID URI. Insufficient length validation during parsing of this URI can lead to an out-of-bounds read, potentially causing a denial of service.
Statement: This is an Important denial of service flaw in PJSIP, a multimedia communication library. A remote attacker can trigger an out-of-bounds read by sending a specially crafted SIP multipart message with a malformed Content-ID URI, leading to service unavailability. This vulnerability affects Red Hat Community Projects that utili
VulDB
pjsip pjproject up to 2.16 Multipart Message out-of-bounds (GHSA-935m-fmf5-j4pm / EUVD-2026-25597)
vuldb·2026-04-24·CVSS 6.7
CVE-2026-41415 [MEDIUM] pjsip pjproject up to 2.16 Multipart Message out-of-bounds (GHSA-935m-fmf5-j4pm / EUVD-2026-25597)
A vulnerability, which was classified as problematic, has been found in pjsip pjproject up to 2.16. Affected by this vulnerability is an unknown functionality of the component Multipart Message Handler. Performing a manipulation results in out-of-bounds read.
This vulnerability is known as CVE-2026-41415. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
bugzilla·2026-04-28·CVSS 6.7
CVE-2026-41415 [MEDIUM] CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
bugzilla·2026-04-28·CVSS 6.7
CVE-2026-41415 [MEDIUM] CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
bugzilla·2026-04-28·CVSS 6.7
CVE-2026-41415 [MEDIUM] CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
bugzilla·2026-04-28·CVSS 6.7
CVE-2026-41415 [MEDIUM] CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
CVE-2026-41415 asterisk: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
bugzilla·2026-04-24·CVSS 6.7
CVE-2026-41415 [MEDIUM] CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
CVE-2026-41415 pjproject: PJSIP: Denial of service via malformed Content-ID URI in SIP multipart message
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.
2026-04-24
Published