pjsip pjproject PJLIB-UTIL HTTP client http_client.c heap-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in pjsip pjproject. The affected element is an unknown function of the file http_client.c of the component PJLIB-UTIL HTTP client. The manipulation results in heap-based overflow. This vulnerability was named CVE-2026-57164. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in pjsip pjproject (the affected version unknown). Affected is an unknown part of the file http_client.c of the component PJLIB-UTIL HTTP client. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response; impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally (via on_data_read), or that only connect to trusted servers, are not affected. This issue has been patched via commit 8d5956a.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-57164 since 06/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Applying the patch 8d5956afab2ede95ddb199078dc19a8ac0114f3d is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• pjsip

Name

• pjproject

License

• open-source

Website

• Product: https://github.com/pjsip/pjproject/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion