CVE-2026-57164 in pjproject
Summary
by MITRE • 09/04/2026
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response; impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally (via on_data_read), or that only connect to trusted servers, are not affected. This issue has been patched via commit 8d5956a.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
PJSIP is a widely utilized free and open source multimedia communication library written in C, serving as the backbone for numerous VoIP, video conferencing, and instant messaging applications across mobile and desktop platforms. The vulnerability under analysis resides within the PJLIB-UTIL HTTP client component, specifically in the file http_client.c. This flaw manifests during the process of buffering an entire HTTP response body at once, a mode triggered when an application utilizes a completion callback without implementing incremental data reading via on_data_read callbacks. In this specific operational context, the library attempts to allocate memory dynamically based on the Content-Length header provided by the remote server. The core technical defect is an incorrect size calculation during buffer growth, which fails to account for necessary overhead or misinterprets the length value, resulting in a heap buffer that is smaller than required to hold the incoming data payload.
When a malicious actor or a man-in-the-middle attacker crafts an HTTP response with a Content-Length header that exceeds the actual body size but triggers this flawed calculation logic, the application writes past the end of the allocated memory block. This constitutes a classic heap-based buffer overflow vulnerability. The immediate operational impact includes unexpected application termination due to segmentation faults when the operating system detects invalid memory access. More critically, if the overwrite affects adjacent metadata or function pointers within the heap structure, it can lead to arbitrary code execution, allowing an attacker to compromise the integrity and confidentiality of the host system. This risk is particularly acute in environments where PJSIP applications interact with untrusted networks or third-party servers that cannot be fully verified for trustworthiness.
From a classification perspective, this vulnerability aligns with CWE-120, Buffer Copy without Checking Size of Input, as it involves writing data to a buffer without proper bounds checking relative to the allocated size. It also relates to CWE-787, Out-of-bounds Write, due to the memory corruption aspect. In terms of adversarial tactics, this flaw can be exploited via MITM attacks or direct interaction with malicious servers, mapping to ATT&CK techniques such as T1059 Command and Scripting Interpreter if code execution is achieved, or generally falling under initial access vectors that leverage software vulnerabilities for exploitation. The vulnerability specifically impacts applications that consume the response incrementally are not affected because they do not rely on the single large allocation logic where the miscalculation occurs. Similarly, applications connecting exclusively to trusted servers mitigate this risk by avoiding exposure to crafted malicious responses.
The issue has been addressed through commit 8d5956a, which corrects the size calculation algorithm to ensure that allocated buffers are sufficiently sized to accommodate the full response body along with any necessary null terminators or internal structures. To maintain security posture, developers and system administrators should immediately update PJSIP libraries to versions containing this patch. For applications where updating is not feasible in the short term, mitigations include enforcing strict validation of HTTP headers before processing, restricting network connections to known trusted endpoints only, and implementing incremental data reading patterns using on_data_read callbacks rather than bulk completion callbacks. Additionally, employing memory-safe languages for new development or utilizing static analysis tools during code reviews can help detect similar buffer handling errors in C-based multimedia libraries. Regular security audits of third-party dependencies are essential to prevent exploitation of such low-level memory management flaws that underpin critical communication infrastructure.