Read the docs
TI-2017-12420 Aliases CVE-2017-16875GHSA-qw72-xqg4-c435

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1.

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.

Why it matters now

EPSS 0.03362 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*before 2.7.1Vulnerableteluu
  • cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* Versions before 2.7.1 Vulnerable ·teluu

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-16875
  2. 2026-10-03 Alias added: GHSA-qw72-xqg4-c435

References

Advisory 3

  • TI-2022-13076 Potential stack buffer overflow when parsing message as a STUN client CVSS 3.1CRITICAL 9.8
  • TI-2023-20051 PJSIP has use-after-free vulnerability in SRTP media transport CVSS 3.1CRITICAL 9.8
  • TI-2022-06096 Out-of-bounds read in multipart parsing in PJSIP CVSS 3.1CRITICAL 9.1
  • TI-2022-07661 Use after free in PJSIP CVSS 3.1CRITICAL 9.8
  • TI-2022-06095 Potential out-of-bound read during RTP/RTCP parsing in PJSIP CVSS 3.1CRITICAL 9.1
  • TI-2021-15581 Potential integer underflow upon receiving STUN message in PJSIP CVSS 3.1CRITICAL 9.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences