CVE-2022-23608 in PJSIP
Summary
by MITRE • 02/22/2022
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2022-23608 affects PJSIP, a widely-used open source multimedia communication library that implements standard protocols including SIP, SDP, RTP, STUN, TURN, and ICE. This library serves as the foundation for numerous VoIP applications and communication systems, making the security implications of this flaw particularly significant. The issue manifests in dialog set or forking scenarios where multiple User Agent Client (UAC) dialogs share a common hash key within the library's internal data structures. The flaw resides in the memory management and hash table handling mechanisms that govern how dialog references are stored and maintained during the lifecycle of communication sessions.
The technical implementation flaw occurs when a dialog set is established and multiple UAC dialogs are registered in the hash table using a shared hash key. When one of these dialogs is destroyed, the system prematurely frees the shared hash key resource, while other dialogs in the same set continue to reference the now-invalidated key. This creates a scenario where the dialog set can be registered multiple times within the hash table using different hash keys, leading to a state of undefined behavior. The hash table collision that results from this improper resource management can cause the system to enter an endless loop during dialog processing operations, effectively creating a denial of service condition that disrupts normal communication flows.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise the stability and reliability of communication systems that depend on PJSIP. Attackers could exploit this weakness by initiating dialog set scenarios, causing the targeted system to enter an infinite loop that consumes CPU resources and prevents legitimate communication from proceeding. This vulnerability particularly affects systems implementing SIP-based communication where forking scenarios are common, such as call routing systems, PBX implementations, and unified communications platforms. The flaw's potential for causing denial of service makes it especially dangerous in mission-critical communication environments where continuous availability is essential. According to CWE classification, this vulnerability maps to CWE-415: Double Free, as it involves improper handling of shared resources leading to premature deallocation, and potentially CWE-691: Insufficient Control Flow Management, due to the resulting infinite loop condition.
Mitigation strategies for CVE-2022-23608 require immediate deployment of the patch referenced in commit db3235953baa56d2fb0e276ca510fefca751643f, which will be included in the next release of PJSIP. Organizations using affected versions should prioritize upgrading their implementations to prevent exploitation. The vulnerability's nature makes it particularly challenging to address through workarounds since the issue stems from fundamental memory management within the library's core operations. System administrators should monitor for the patched version and ensure all communication systems utilizing PJSIP are updated promptly. From an ATT&CK framework perspective, this vulnerability aligns with T1499.004: Endpoint Denial of Service, as it enables adversaries to disrupt service availability through resource exhaustion. The flaw also represents a potential entry point for more sophisticated attacks targeting communication infrastructure, making proactive patch management essential for maintaining secure communication environments. Organizations should implement automated patch management processes to ensure timely deployment of security fixes and maintain inventory of all systems using PJSIP to facilitate rapid remediation efforts.