pjsip pjproject
47 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84975 | <= 2.17 | PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends) | HIGH 7.4 | 0.2 % | ||
| CVE-2026-77396 | <= 2.17 | PJSIP: Heap buffer overflow in the AVI parser | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-57166 | < 4472a31d77a7506ff175dad5abef490f4e31bed1 | PJSIP: Pre-authentication overflow in the telnet CLI error | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-57165 | < 628b71638465bacf66e767959e6acbab822eccd6 | PJSIP: Pre-authentication overflow in the telnet CLI history | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-57164 | < 8d5956afab2ede95ddb199078dc19a8ac0114f3d | PJSIP: Heap overflow in the HTTP client | HIGH 8.3 | 0.5 % | ||
| CVE-2026-57163 | < c4a151af86fadd16d9480b2603eeb2abf4fb4f78 | PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend | HIGH 8.8 | 0.4 % | ||
| CVE-2026-57162 | < a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 | PJSIP: Stack overflow parsing SDP a=crypto attributes | HIGH 8.8 | 0.6 % | ||
| CVE-2026-57161 | < acc03b57cef7a7d31b8e1f5b9117437d7e87c591 | PJSIP: Stack overflow handling Service-Route headers in a registration response | HIGH 8.8 | 0.5 % | ||
| CVE-2026-57160 | < d6a0e7f76611c3a6f530ee051e3e7a622bb1748c | PJSIP: SIP message header buffer overflow | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-57159 | < 673b978aab1fe3ab874247be32c871acc880cbeb | PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance | HIGH 8.4 | 0.6 % | ||
| CVE-2026-42225 | < 2.17 | GnuTLS backend silently skips certificate chain verification when verify_peer is false | HIGH 8.2 | 0.2 % | ||
| CVE-2026-41416 | < 2.17 | PJSIP: Asymmetric ptime integer overflow in Media Stream | HIGH 8.1 | 0.3 % | ||
| CVE-2026-41415 | < 2.17 | PJSIP: SIP Multipart CID URI Length Underflow | MEDIUM 6.7 | 0.3 % | ||
| CVE-2026-40892 | <= 2.16 | PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() | HIGH 8.1 | 0.4 % | ||
| CVE-2026-40614 | <= 2.16 | PJSIP: Heap buffer overflow in Opus codec decoding | HIGH 8.5 | 0.2 % | ||
| CVE-2026-34235 | < 2.17 | PJSIP: Heap OOB read in VPX unpacketizer | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-33069 | < 2.17 | PJSIP has an Out-of-bounds Read in SIP multipart parsing | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-32945 | < 2.17 | PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser | HIGH 8.4 | 0.3 % | ||
| CVE-2026-32942 | < 2.17 | PJSIP has ICE session use-after-free race conditions | HIGH 8.0 | 0.3 % | ||
| CVE-2026-28799 | < 2.17 | PJSIP: Heap use-after-free in PJSIP presence subscription termination handler | HIGH 8.7 | 0.3 % | ||
| CVE-2026-29068 | < 2.17 | PJSIP: Stack buffer overflow in Opus codec parser | HIGH 8.7 | 0.3 % | ||
| CVE-2026-26967 | < f821c214e52b11bae11e4cd3c7f0864538fb5491 | PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer | HIGH 8.1 | 0.3 % | ||
| CVE-2026-25994 | <= 2.16 | PJSIP has a heap buffer overflow in ICE with long username | HIGH 8.1 | 2.1 % | ||
| CVE-2025-65102 | < 2.16 | PJSIP is vulnerable to buffer overflow in Opus PLC | HIGH 8.7 | 0.3 % | ||
| CVE-2023-38703 | <= 2.13.1 | PJSIP has use-after-free vulnerability in SRTP media transport | CRITICAL 9.8 | 1.6 % | ||
| CVE-2023-27585 | <= 2.13 | PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior af | HIGH 7.5 | 2.3 % | ||
| CVE-2022-23547 | <= 2.13 | Heap buffer overflow in pjproject when decoding STUN message | CRITICAL 9.8 | 1.0 % | ||
| CVE-2022-23537 | <= 2.13 | PJSIP vulnerable to heap buffer overflow when decoding STUN message | CRITICAL 9.8 | 1.1 % | ||
| CVE-2022-39269 | >= 2.11, < 2.13 | Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip | CRITICAL 9.1 | 0.7 % | ||
| CVE-2022-39244 | < 2.13 | Buffer overflow in pjlib scanner and pjmedia | CRITICAL 9.8 | 1.5 % | ||
| CVE-2022-31031 | <= 2.12.1 | Potential stack buffer overflow when parsing message as a STUN client | CRITICAL 9.8 | 2.1 % | ||
| CVE-2022-24792 | <= 2.12 | Potential infinite loop when parsing WAV format file in PJSIP | HIGH 7.5 | 2.1 % | ||
| CVE-2022-24793 | <= 2.12 | Potential heap buffer overflow when parsing DNS packets in PJSIP | HIGH 7.5 | 2.2 % | ||
| CVE-2022-24786 | <= 2.12 | Potential out-of-bound read/write in PJSIP | CRITICAL 9.8 | 2.1 % | ||
| CVE-2022-24763 | <= 2.12 | Infinite Loop in PJSIP | HIGH 7.5 | 2.1 % | ||
| CVE-2022-24764 | <= 2.12 | Stack buffer overflow in pjproject | HIGH 7.5 | 2.4 % | ||
| CVE-2022-24754 | <= 2.12 | Buffer overflow in pjsip | CRITICAL 9.8 | 2.1 % | ||
| CVE-2022-23608 | <= 2.11.1 | Use after free in PJSIP | CRITICAL 9.8 | 4.0 % | ||
| CVE-2022-21723 | <= 2.11.1 | Out-of-bounds read in multipart parsing in PJSIP | CRITICAL 9.1 | 4.4 % | ||
| CVE-2022-21722 | <= 2.11.1 | Potential out-of-bound read during RTP/RTCP parsing in PJSIP | CRITICAL 9.1 | 2.3 % | ||
| CVE-2021-41141 | <= 2.11.1 | Missing release of locks in PJSIP | HIGH 7.5 | 1.4 % | ||
| CVE-2021-43845 | <= 2.11.1 | Prevent out-of-bounds read in PJSIP | CRITICAL 9.1 | 3.9 % | ||
| CVE-2021-43804 | <= 2.11.1 | Out-of-bounds read when parsing RTCP BYE message in PJSIP | HIGH 7.3 | 2.3 % | ||
| CVE-2021-37706 | <= 2.11.1 | Potential integer underflow upon receiving STUN message in PJSIP | CRITICAL 9.8 | 4.9 % | ||
| CVE-2021-32686 | < 2.11.1 | Denial of Service in PJSIP | MEDIUM 5.9 | 2.1 % | ||
| CVE-2021-21375 | <= 2.10 | Crash in receiving updated SDP answer after initial SDP negotiation failed | MEDIUM 6.5 | 2.1 % | ||
| CVE-2020-15260 | <= 2.10 | Existing TLS connections can be reused without checking remote hostname | MEDIUM 6.8 | 1.0 % |