CVE-2026-42225: GnuTLS backend silently skips certificate chain verification when verify_peer is false
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (siptransporttls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verifyserver = PJTRUE or verifyclient = PJTRUE. This issue has been patched in version 2.17.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42225?
CVE-2026-42225 has a medium severity due to the risk of bypassing certificate chain verification.
How do I fix CVE-2026-42225?
To fix CVE-2026-42225, upgrade PJSIP to version 2.17 or later.
What is the impact of CVE-2026-42225?
The impact of CVE-2026-42225 is that it allows connections with invalid or untrusted certificates.
Which versions of PJSIP are affected by CVE-2026-42225?
PJSIP versions prior to 2.17 are affected by CVE-2026-42225.
What component of PJSIP is impacted by CVE-2026-42225?
CVE-2026-42225 impacts the SIP TLS transport (sip_transport_tls) component of PJSIP.