CVE-2026-57161: PJSIP: Stack overflow handling Service-Route headers in a registration response
PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (updateserviceroute() in pjsuaacc.c). This affects applications that register using the PJSUA/PJSUA2 account API (the default registration path). The Service-Route URIs from a 2xx response to REGISTER are stored into a fixed-size array without bounding the number of headers; a registrar that returns an excessive number of Service-Route headers can write past the end of the array on the stack. The values written are internal pointers rather than arbitrary data, so the most likely impact is unexpected application termination (denial of service), though memory corruption cannot be excluded. The malicious response may come from a compromised or malicious registrar, or — over unprotected transports — a spoofed response. This issue has been patched via commit acc03b5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIPto a version that resolves this vulnerability.Patch acc03b5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications that register through the PJSUA or PJSUA2 account API are affected, because this is the default registration path. The vulnerable behavior occurs while processing Service-Route headers in a successful 2xx response to REGISTER.
What does an attacker need to exploit it?
An attacker needs to cause the application to receive a registration response containing an excessive number of Service-Route headers. This could be a malicious or compromised registrar, or a spoofed response when unprotected transports are used.
What impact should operators expect?
The most likely result is unexpected application termination, causing denial of service. Because the overflow corrupts memory, additional effects cannot be excluded, although the overwritten values are internal pointers rather than attacker-controlled arbitrary data.
What should be done if immediate patching is not possible?
Use protected transports for registration traffic to reduce the risk of spoofed registration responses, and avoid registering against untrusted or potentially compromised registrars. Apply the fix in commit acc03b5 when possible.