Read the docs
TI-2022-06096 Aliases CVE-2022-21723

Out-of-bounds read in multipart parsing in PJSIP

Priority MEDIUM 52CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04357 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pjsippjprojectup to 2.11.1—No fix listedCNA
  • pjproject Vendorpjsip Affected up to 2.11.1 Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*up to 2.11.1Vulnerableteluu
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:*:*:*:*:*:*:*16.8.0Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*16.8.0 cert1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*16.8.0 cert10Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*16.8.0 cert11Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*16.8.0 cert12Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*16.8.0 cert2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*16.8.0 cert3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*16.8.0 cert4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*16.8.0 cert5Vulnerableasterisk
  • cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* Versions up to 2.11.1 Vulnerable ·teluu
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:*:*:*:*:*:*:* Versions 16.8.0 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:* Versions 16.8.0 cert1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:* Versions 16.8.0 cert10 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:* Versions 16.8.0 cert11 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:* Versions 16.8.0 cert12 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:* Versions 16.8.0 cert2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:* Versions 16.8.0 cert3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:* Versions 16.8.0 cert4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:* Versions 16.8.0 cert5 Vulnerable ·asterisk
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*16.8.0 cert6Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*16.8.0 cert7Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*16.8.0 cert8Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*16.8.0 cert9Vulnerableasterisk
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*16.0.0 to before 16.24.1; 18.0.0 to before 18.10.1; 19.0.0 to before 19.2.1VulnerableSangoma
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:* Versions 16.8.0 cert6 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:* Versions 16.8.0 cert7 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:* Versions 16.8.0 cert8 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:* Versions 16.8.0 cert9 Vulnerable ·asterisk
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions 16.0.0 to before 16.24.1; 18.0.0 to before 18.10.1; 19.0.0 to before 19.2.1 Vulnerable ·Sangoma
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21723

References

Patch 3

Advisory 5

Other 1

  • TI-2022-13076 Potential stack buffer overflow when parsing message as a STUN client CVSS 3.1CRITICAL 9.8
  • TI-2022-08599 Potential out-of-bound read/write in PJSIP CVSS 3.1CRITICAL 9.8
  • TI-2023-20051 PJSIP has use-after-free vulnerability in SRTP media transport CVSS 3.1CRITICAL 9.8
  • TI-2022-07661 Use after free in PJSIP CVSS 3.1CRITICAL 9.8
  • TI-2022-06095 Potential out-of-bound read during RTP/RTCP parsing in PJSIP CVSS 3.1CRITICAL 9.1
  • TI-2021-15581 Potential integer underflow upon receiving STUN message in PJSIP CVSS 3.1CRITICAL 9.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences