# cve.now: Pjsip

The newest entries naming Pjsip as an affected vendor (up to 200), of 48 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-84975](https://cve.now/CVE-2026-84975.md): PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends) (CVSS 7.4)
- [CVE-2026-77396](https://cve.now/CVE-2026-77396.md): PJSIP: Heap buffer overflow in the AVI parser (CVSS 6.9)
- [CVE-2026-57166](https://cve.now/CVE-2026-57166.md): PJSIP: Pre-authentication overflow in the telnet CLI error (CVSS 6.3)
- [CVE-2026-57165](https://cve.now/CVE-2026-57165.md): PJSIP: Pre-authentication overflow in the telnet CLI history (CVSS 6.3)
- [CVE-2026-57164](https://cve.now/CVE-2026-57164.md): PJSIP: Heap overflow in the HTTP client (CVSS 8.3)
- [CVE-2026-57163](https://cve.now/CVE-2026-57163.md): PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend (CVSS 8.8)
- [CVE-2026-57162](https://cve.now/CVE-2026-57162.md): PJSIP: Stack overflow parsing SDP a=crypto attributes (CVSS 8.8)
- [CVE-2026-57161](https://cve.now/CVE-2026-57161.md): PJSIP: Stack overflow handling Service-Route headers in a registration response (CVSS 8.8)
- [CVE-2026-57160](https://cve.now/CVE-2026-57160.md): PJSIP: SIP message header buffer overflow (CVSS 6.9)
- [CVE-2026-57159](https://cve.now/CVE-2026-57159.md): PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance (CVSS 8.4)
- [CVE-2026-42225](https://cve.now/CVE-2026-42225.md): GnuTLS backend silently skips certificate chain verification when verify\_peer is false (CVSS 8.2)
- [CVE-2026-41416](https://cve.now/CVE-2026-41416.md): PJSIP: Asymmetric ptime integer overflow in Media Stream (CVSS 8.1)
- [CVE-2026-41415](https://cve.now/CVE-2026-41415.md): PJSIP: SIP Multipart CID URI Length Underflow (CVSS 6.7)
- [CVE-2026-40892](https://cve.now/CVE-2026-40892.md): PJSIP: Stack buffer overflow in pjsip\_auth\_create\_digest2() (CVSS 8.1)
- [CVE-2026-40614](https://cve.now/CVE-2026-40614.md): PJSIP: Heap buffer overflow in Opus codec decoding (CVSS 8.5)
- [CVE-2026-34235](https://cve.now/CVE-2026-34235.md): PJSIP: Heap OOB read in VPX unpacketizer (CVSS 6.9)
- [CVE-2026-33069](https://cve.now/CVE-2026-33069.md): PJSIP has an Out-of-bounds Read in SIP multipart parsing (CVSS 6.9)
- [CVE-2026-32945](https://cve.now/CVE-2026-32945.md): PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser (CVSS 8.4)
- [CVE-2026-32942](https://cve.now/CVE-2026-32942.md): PJSIP has ICE session use-after-free race conditions (CVSS 8.0)
- [CVE-2026-28799](https://cve.now/CVE-2026-28799.md): PJSIP: Heap use-after-free in PJSIP presence subscription termination handler (CVSS 8.7)
- [CVE-2026-29068](https://cve.now/CVE-2026-29068.md): PJSIP: Stack buffer overflow in Opus codec parser (CVSS 8.7)
- [CVE-2026-26967](https://cve.now/CVE-2026-26967.md): PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer (CVSS 8.1)
- [CVE-2026-26203](https://cve.now/CVE-2026-26203.md): PJSIP's pjmedia-video has use-after-free in H264 packetizer when packetizing fragmented NAL (CVSS 5.1)
- [CVE-2026-25994](https://cve.now/CVE-2026-25994.md): PJSIP has a heap buffer overflow in ICE with long username (CVSS 8.1)
- [CVE-2025-65102](https://cve.now/CVE-2025-65102.md): PJSIP is vulnerable to buffer overflow in Opus PLC (CVSS 8.7)
- [CVE-2023-38703](https://cve.now/CVE-2023-38703.md): PJSIP has use-after-free vulnerability in SRTP media transport (CVSS 9.8)
- [CVE-2023-27585](https://cve.now/CVE-2023-27585.md): PJSIP is a free and open source multimedia communication library written in C. (CVSS 7.5)
- [CVE-2022-23547](https://cve.now/CVE-2022-23547.md): Heap buffer overflow in pjproject when decoding STUN message (CVSS 6.5)
- [CVE-2022-23537](https://cve.now/CVE-2022-23537.md): PJSIP vulnerable to heap buffer overflow when decoding STUN message (CVSS 6.5)
- [CVE-2022-39269](https://cve.now/CVE-2022-39269.md): Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip (CVSS 9.1)
- [CVE-2022-39244](https://cve.now/CVE-2022-39244.md): Buffer overflow in pjlib scanner and pjmedia (CVSS 7.5)
- [CVE-2022-31031](https://cve.now/CVE-2022-31031.md): Potential stack buffer overflow when parsing message as a STUN client (CVSS 9.8)
- [CVE-2022-24792](https://cve.now/CVE-2022-24792.md): Potential infinite loop when parsing WAV format file in PJSIP (CVSS 7.5)
- [CVE-2022-24793](https://cve.now/CVE-2022-24793.md): Potential heap buffer overflow when parsing DNS packets in PJSIP (CVSS 7.5)
- [CVE-2022-24786](https://cve.now/CVE-2022-24786.md): Potential out-of-bound read/write in PJSIP (CVSS 9.8)
- [CVE-2022-24763](https://cve.now/CVE-2022-24763.md): Infinite Loop in PJSIP (CVSS 7.5)
- [CVE-2022-24764](https://cve.now/CVE-2022-24764.md): Stack buffer overflow in pjproject (CVSS 7.5)
- [CVE-2022-24754](https://cve.now/CVE-2022-24754.md): Buffer overflow in pjsip (CVSS 8.5)
- [CVE-2022-23608](https://cve.now/CVE-2022-23608.md): Use after free in PJSIP (CVSS 8.1)
- [CVE-2022-21723](https://cve.now/CVE-2022-21723.md): Out-of-bounds read in multipart parsing in PJSIP (CVSS 9.1)
- [CVE-2022-21722](https://cve.now/CVE-2022-21722.md): Potential out-of-bound read during RTP/RTCP parsing in PJSIP (CVSS 9.1)
- [CVE-2021-41141](https://cve.now/CVE-2021-41141.md): Missing release of locks in PJSIP (CVSS 5.9)
- [CVE-2021-43845](https://cve.now/CVE-2021-43845.md): Prevent out-of-bounds read in PJSIP (CVSS 8.2)
- [CVE-2021-43804](https://cve.now/CVE-2021-43804.md): Out-of-bounds read when parsing RTCP BYE message in PJSIP (CVSS 7.3)
- [CVE-2021-37706](https://cve.now/CVE-2021-37706.md): Potential integer underflow upon receiving STUN message in PJSIP (CVSS 7.3)
- [CVE-2021-32686](https://cve.now/CVE-2021-32686.md): Denial of Service in PJSIP (CVSS 5.9)
- [CVE-2021-21375](https://cve.now/CVE-2021-21375.md): Crash in receiving updated SDP answer after initial SDP negotiation failed (CVSS 6.5)
- [CVE-2020-15260](https://cve.now/CVE-2020-15260.md): Existing TLS connections can be reused without checking remote hostname (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pjsip
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.