PJ
Product
pjproject
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 11Medium 6Low 0
Watch
Add pjproject to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40892 | 9.8 | Apr 21 | PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() Affected: <= 2.16 |
| CVE-2026-32945 | 9.8 | Mar 20 | PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser Affected: < 2.17 |
| CVE-2026-25994 | 9.8 | Feb 11 | PJSIP has a heap buffer overflow in ICE with long username Affected: <= 2.16 |
| CVE-2022-39244 | 9.8 | Oct 6 | Buffer overflow in pjlib scanner and pjmedia Affected: < 2.13 |
| CVE-2026-57163 | 9.1 | Sep 4 | PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend Affected: < c4a151af86fadd16d9480b2603eeb2abf4fb4f78 |
| CVE-2026-57162 | 9.1 | Sep 4 | PJSIP: Stack overflow parsing SDP a=crypto attributes Affected: < a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9 |
| CVE-2026-41415 | 9.1 | Apr 24 | PJSIP: SIP Multipart CID URI Length Underflow Affected: < 2.17 |
| CVE-2026-34235 | 9.1 | Mar 31 | PJSIP: Heap OOB read in VPX unpacketizer Affected: < 2.17 |
| CVE-2022-39269 | 9.1 | Oct 6 | Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip Affected: >= 2.11, < 2.13 |
| CVE-2026-40614 | 8.8 | Apr 21 | PJSIP: Heap buffer overflow in Opus codec decoding Affected: <= 2.16 |
| CVE-2025-65102 | 8.7 | Nov 21 | PJSIP is vulnerable to buffer overflow in Opus PLC Affected: < 2.16 |
| CVE-2026-57161 | 8.2 | Sep 4 | PJSIP: Stack overflow handling Service-Route headers in a registration response Affected: < acc03b57cef7a7d31b8e1f5b9117437d7e87c591 |
| CVE-2026-32942 | 8.1 | Mar 20 | PJSIP has ICE session use-after-free race conditions Affected: < 2.17 |
| CVE-2026-57159 | 7.5 | Sep 4 | PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance Affected: < 673b978aab1fe3ab874247be32c871acc880cbeb |
| CVE-2026-41416 | 7.5 | Apr 24 | PJSIP: Asymmetric ptime integer overflow in Media Stream Affected: < 2.17 |
| CVE-2026-33069 | 7.5 | Mar 20 | PJSIP has an Out-of-bounds Read in SIP multipart parsing Affected: < 2.17 |
| CVE-2026-28799 | 7.5 | Mar 6 | PJSIP: Heap use-after-free in PJSIP presence subscription termination handler Affected: < 2.17 |
| CVE-2026-29068 | 7.5 | Mar 6 | PJSIP: Stack buffer overflow in Opus codec parser Affected: < 2.17 |
| CVE-2026-84975 | 7.4 | Sep 18 | PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends) Affected: <= 2.17 |
| CVE-2026-77396 | 7.1 | Sep 18 | PJSIP: Heap buffer overflow in the AVI parser Affected: <= 2.17 |
| CVE-2026-57164 | 5.9 | Sep 4 | PJSIP: Heap overflow in the HTTP client Affected: < 8d5956afab2ede95ddb199078dc19a8ac0114f3d |
| CVE-2026-42225 | 5.9 | May 7 | GnuTLS backend silently skips certificate chain verification when verify_peer is false Affected: < 2.17 |
| CVE-2026-57166 | 5.3 | Sep 4 | PJSIP: Pre-authentication overflow in the telnet CLI error Affected: < 4472a31d77a7506ff175dad5abef490f4e31bed1 |
| CVE-2026-57165 | 5.3 | Sep 4 | PJSIP: Pre-authentication overflow in the telnet CLI history Affected: < 628b71638465bacf66e767959e6acbab822eccd6 |
| CVE-2026-57160 | 5.3 | Sep 4 | PJSIP: SIP message header buffer overflow Affected: < d6a0e7f76611c3a6f530ee051e3e7a622bb1748c |
| CVE-2026-26967 | 5.3 | Feb 20 | PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer Affected: < f821c214e52b11bae11e4cd3c7f0864538fb5491 |
Showing 26
