CVE-2026-32945 Details
Description
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip_resolver_set_ext_resolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameserver_count to zero) or to use an external resolver implementation instead.
A heap-based buffer overflow vulnerability has been identified in PJSIP versions 2.16 and below. The issue arises in the DNS parser's name length handler, affecting applications that use PJSIP's built-in DNS resolver. This vulnerability does not impact users who rely on the operating system's resolver or those using an external resolver implementation.
Users can upgrade to PJSIP version 2.17, where this vulnerability is patched. For those unable to upgrade, DNS resolution can be disabled in the PJSIP configuration by setting the nameserver_count to zero, or an external resolver implementation can be used instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199 | [email protected] | Patch |
| https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pjsip pjsip | < 2.17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |