Skip to content
OpenAdvisories
High WID-SEC-2026-1983 8 CVEs

PJSIP: Mehrere Schwachstellen

Published Jun 16, 2026 · Updated Sep 6, 2026 · Revision 2 · de-DE

Platform: Android Platform: iOS Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in PJSIP ausnutzen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.

Product

PJSIP ist eine freie und quelloffene Multimediabibliothek, die das Session Initiation Protocol (SIP) implementiert.

Vulnerabilities 8

  • High 8.8
    CVE-2026-57161

    PJSIP: Stack overflow handling Service-Route headers in a registration response

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affe…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • High 8.8
    CVE-2026-57162

    PJSIP: Stack overflow parsing SDP a=crypto attributes

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • High 8.8
    CVE-2026-57163

    PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in …

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • High 8.4
    CVE-2026-57159

    PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • High 8.3
    CVE-2026-57164

    PJSIP: Heap overflow in the HTTP client

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJ…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • Medium 6.9
    CVE-2026-57160

    PJSIP: SIP message header buffer overflow

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Al…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • Medium 6.3
    CVE-2026-57165

    PJSIP: Pre-authentication overflow in the telnet CLI history

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • Medium 6.3
    CVE-2026-57166

    PJSIP: Pre-authentication overflow in the telnet CLI error

    PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling pa…

    pjsip pjproject asterisk asterisk Debian Ubuntu

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-57165, EUVD-2026-71659, CVE-2026-57159, EUVD-2026-71653, CVE-2026-57164, EUVD-2026-71658, CVE-2026-57163, EUVD-2026-71657, CVE-2026-57166, EUVD-2026-71660, CVE-2026-57160, EUVD-2026-71654, CVE-2026-57161, EUVD-2026-71655, CVE-2026-57162, EUVD-2026-71656

  2. #1

    Initiale Fassung

References