---
id: CVE-2026-57163
title: PJSIP is a free and open source multimedia communication library written in C
summary: >-
  PJSIP is a free and open source multimedia communication library written in C.
  Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS
  backend when parsing the Subject Alternative Name extension of a peer
  certificate (t…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-121
vendor: teluu
product: pjsip
affected:
  - pjsip <= 2.17
published: '2026-09-04'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T15:51:33.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57163'
references:
  - url: >-
      https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78
    label: security-advisories@github.com
  - url: 'https://github.com/pjsip/pjproject/security/advisories/GHSA-jm2j-6rg6-qvwx'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57163.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-57163'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-57163'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00402
epssPercentile: 0.31801
scores:
  nvd: 9.1
  vendor: 9.8
ingestedAt: '2026-09-08T22:12:30.947Z'
---

## Overview

PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted certificate — a malicious server to a connecting client, or a malicious client to a server that requests certificates — can trigger this during the TLS handshake, before any SIP-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. This issue has been patched via commit c4a151a.

## Affected

- `pjsip <= 2.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57163.json)