TI-2021-15581 Aliases CVE-2021-37706

Potential integer underflow upon receiving STUN message in PJSIP

MEDIUM 50CWE-191Published 2021-12-22 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Why it matters now

EPSS 0.04924 92nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pjsip	pjproject	up to 2.11.1	—	No fix listed	CNA

pjproject Vendorpjsip Affected up to 2.11.1 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPE	Versions	Role	Vendor
cpe:2.3:a:teluu:pjsip::::::::	up to 2.11.1	Vulnerable	teluu
cpe:2.3:a:asterisk:certified_asterisk::::::::	before 16.8.0	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:::::::*	16.8.0	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1::::::	16.8.0 cert1	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10::::::	16.8.0 cert10	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11::::::	16.8.0 cert11	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12::::::	16.8.0 cert12	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2::::::	16.8.0 cert2	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3::::::	16.8.0 cert3	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4::::::	16.8.0 cert4	Vulnerable	asterisk

cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* Versions up to 2.11.1 Vulnerable ·teluu
cpe:2.3:a:asterisk:certified_asterisk:*:*:*:*:*:*:*:* Versions before 16.8.0 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:*:*:*:*:*:*:* Versions 16.8.0 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:* Versions 16.8.0 cert1 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:* Versions 16.8.0 cert10 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:* Versions 16.8.0 cert11 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:* Versions 16.8.0 cert12 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:* Versions 16.8.0 cert2 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:* Versions 16.8.0 cert3 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:* Versions 16.8.0 cert4 Vulnerable ·asterisk

Show 8 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5::::::	16.8.0 cert5	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6::::::	16.8.0 cert6	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7::::::	16.8.0 cert7	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8::::::	16.8.0 cert8	Vulnerable	asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9::::::	16.8.0 cert9	Vulnerable	asterisk
cpe:2.3:a:sangoma:asterisk::::::::	16.0.0 to before 16.24.1; 18.0.0 to before 18.10.1; 19.0.0 to before 19.2.1	Vulnerable	Sangoma
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:* Versions 16.8.0 cert5 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:* Versions 16.8.0 cert6 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:* Versions 16.8.0 cert7 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:* Versions 16.8.0 cert8 Vulnerable ·asterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:* Versions 16.8.0 cert9 Vulnerable ·asterisk
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions 16.0.0 to before 16.24.1; 18.0.0 to before 18.10.1; 19.0.0 to before 19.2.1 Vulnerable ·Sangoma
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2021-37706

References

Patch 3

Advisory 5

Other 1

[debian-lts-announce] 20230829 [SECURITY] [DLA 3549-1] ring security update

TI-2022-13076 Potential stack buffer overflow when parsing message as a STUN client CVSS 3.1CRITICAL 9.8
TI-2022-08599 Potential out-of-bound read/write in PJSIP CVSS 3.1CRITICAL 9.8
TI-2023-20051 PJSIP has use-after-free vulnerability in SRTP media transport CVSS 3.1CRITICAL 9.8
TI-2022-06096 Out-of-bounds read in multipart parsing in PJSIP CVSS 3.1CRITICAL 9.1
TI-2022-07661 Use after free in PJSIP CVSS 3.1CRITICAL 9.8
TI-2022-06095 Potential out-of-bound read during RTP/RTCP parsing in PJSIP CVSS 3.1CRITICAL 9.1

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences