Pjsip Pjproject vulnerabilities

CVE-2021-41141 [HIGH] CWE-667 CVE-2021-41141: PJSIP is a free and open source multimedia communication library written in the C language implement PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function returns without releasing the currently held locks. This could result in a system deadlock, whic

CVE-2017-9359 [HIGH] CVE-2017-9359: The multi-part body parser in PJSIP, as used in Asterisk Open Source 13 The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.

CVE-2026-57166 [MEDIUM] CWE-121 CVE-2026-57166: PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient b

CVE-2020-15260 [MEDIUM] CWE-297 CVE-2020-15260: PJSIP is a free and open source multimedia communication library written in C language implementing PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote

CVE-2026-57165 [MEDIUM] CWE-121 CVE-2026-57165: PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b7 PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet.c). This affects only applications that enable the telnet CLI front-end (same gating as the

CVE-2026-57164 [MEDIUM] CWE-122 CVE-2026-57164: PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d595 PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no

CVE-2026-57160 [MEDIUM] CWE-193 CVE-2026-57160: PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions t

CVE-2026-26967 [MEDIUM] CWE-122 CVE-2026-26967: PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are w

CVE-2021-21375 [MEDIUM] CWE-400 CVE-2021-21375: PJSIP is a free and open source multimedia communication library written in C language implementing PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This

CVE-2026-42225 [MEDIUM] CWE-295 CVE-2026-42225: PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17 PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. T

CVE-2021-32686 [MEDIUM] CWE-362 CVE-2021-32686: PJSIP is a free and open source multimedia communication library written in C language implementing PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group

CVE-2026-77396 [HIGH] CWE-122 CVE-2026-77396: PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attac