CVE-2026-57164: PJSIP: Heap overflow in the HTTP client
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (httpclient.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental ondataread callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response; impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally (via ondataread), or that only connect to trusted servers, are not affected. This issue has been patched via commit 8d5956a.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PJSIP/PJLIB-UTIL HTTP client (http_client.c)to a version that resolves this vulnerability.Patch 8d5956a
Event History
Frequently Asked Questions
Which applications are affected by this issue?
Applications are affected if they use the PJLIB-UTIL HTTP client and buffer an entire HTTP response body for a completion callback without configuring an incremental on_data_read callback. Applications that process response data incrementally through on_data_read are not affected.
What does an attacker need to exploit the flaw?
An attacker needs to control the HTTP server response or be positioned to modify responses as a man-in-the-middle. The crafted response abuses the server-supplied Content-Length while the client grows its response buffer.
Are deployments that communicate only with trusted HTTP servers affected?
The issue is not considered to affect applications that only connect to trusted servers. Exposure exists when an untrusted or attacker-controlled server can provide HTTP responses, or when a man-in-the-middle can alter them.
What can be done if the patch cannot be applied immediately?
Configure the HTTP client to consume response data incrementally using an on_data_read callback rather than buffering the whole body. Restricting connections to trusted servers also avoids the described attack scenario.
How can I determine whether the issue has been fixed?
Verify whether the PJSIP source includes commit 8d5956a, which patches the vulnerable response-buffer growth logic in http_client.c. The full referenced commit identifier is 8d5956afab2ede95ddb199078dc19a8ac0114f3d.