CVE-2026-57163: PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tlscertgetinfo() in sslsockgtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted certificate — a malicious server to a connecting client, or a malicious client to a server that requests certificates — can trigger this during the TLS handshake, before any SIP-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. This issue has been patched via commit c4a151a.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIP (GnuTLS backend)to a version that resolves this vulnerability.Fixed in c4a151a
Event History
Frequently Asked Questions
Which deployments are affected?
Only PJSIP builds using the GnuTLS TLS backend, enabled with --with-gnutls, are affected. Builds using OpenSSL or Apple SecureTransport/Network.framework are not affected.
What access does an attacker need to trigger the flaw?
An attacker must be able to present a crafted TLS certificate to the PJSIP endpoint. This can be a malicious server contacted by a client, or a malicious client connecting to a server that requests client certificates.
Does SIP authentication prevent exploitation?
No. The vulnerable certificate parsing occurs during the TLS handshake, before SIP-level authentication.
How can I determine whether my deployment needs remediation?
Check whether the deployed PJSIP build was compiled with the GnuTLS backend and whether it includes commit c4a151a. If it uses OpenSSL or Apple SecureTransport/Network.framework, this issue does not apply.
What should be done if updating is not immediately possible?
Avoid establishing TLS connections with untrusted peers where possible, since exploitation requires the attacker to present a crafted certificate. Prioritize updating affected GnuTLS builds to include commit c4a151a.