Vulnerabilidades do Teluu Pjsip
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Teluu Pjsip: 4 registro(s), com versões afetadas e correções.cpe:2.3:a:teluu:pjsip
CVE-2026-42225
Média · 5.9
CWE-295 07/05/2026
GnuTLS backend silently skips certificate chain verification when verify_peer is false
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.
CVE-2026-41416
Alta · 7.5
CWE-190 24/04/2026
PJSIP: Asymmetric ptime integer overflow in Media Stream
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.
CVE-2026-41415
Crítica · 9.1
CWE-125 24/04/2026
PJSIP: SIP Multipart CID URI Length Underflow
PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.
CVE-2026-34235
Crítica · 9.1
CWE-125 31/03/2026
PJSIP: Heap OOB read in VPX unpacketizer
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.