PT-2026-26552 · Pjsip · Pjsip

Sauwming · Publicado 2026-03-20 · Atualizado 2026-03-24 · CVE-2026-32945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.16 and below

Description PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a Heap-based Buffer Overflow in the DNS parser's name length handler. This impacts applications using PJSIP’s built-in DNS resolver, such as those configured with pjsua config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. Users who rely on the operating system resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip resolver set ext resolver(), are not affected.

Recommendations Versions 2.16 and below: Upgrade to version 2.17 or disable DNS resolution in the PJSIP configuration by setting nameserver count to zero, or use an external resolver implementation.

Exploit

Correção

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

CVE-2026-32945

GHSA-JR2P-P2W4-RR9Q

Produtos afetados

Pjsip

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32945.json · Exploit
• https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199 · Correção
• https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q · Aviso do Fabricante
• https://twitter.com/VolerionSec/status/2034847470681796726 · Publicação no Twitter
• https://security.alpinelinux.org/vuln/CVE-2026-32945 · Nota
• https://twitter.com/CVEnew/status/2034891567681478711 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2034862591705592318 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-32945 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32945 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32945 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-32945 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32945 · Nota de Segurança
• https://twitter.com/dailycve/status/2036281695196914096 · Publicação no Twitter
• https://osv.dev/vulnerability/ALPINE-CVE-2026-32945 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-32945 · Aviso do Fabricante