CVE-2026-57160: PJSIP: SIP message header buffer overflow
PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint() in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code execution and information disclosure are not demonstrated, and in typical pool-based allocations the byte falls within allocation slack. This issue has been patched via commit d6a0e7f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Patch d6a0e7f
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that parse and then re-serialize SIP requests are the main exposure, including proxies, session border controllers (SBCs), and back-to-back user agents (B2BUAs). A remote SIP peer must be able to influence a message that the application serializes.
What is the practical impact of the overflow?
The affected function can write one fixed byte past the output buffer under certain boundary conditions. Code execution and information disclosure have not been demonstrated, and typical pool-based allocations place that byte in allocation slack.
How can I determine whether a deployment needs remediation?
Check whether the PJSIP source includes commit d6a0e7f76611c3a6f530ee051e3e7a622bb1748c. Deployments using code before that commit, particularly those that re-serialize remotely supplied SIP requests, need the patch.