Which versions of PJSIP pjproject are affected by CVE-2026-57164?

PJSIP pjproject's HTTP client contains a high-severity heap buffer overflow flaw that enables denial of service or potential remote code execution when applications receive HTTP responses with…. A patch is available.

How to fix or mitigate CVE-2026-57164?

Within 24 hours, inventory all applications using PJSIP pjproject library and verify which versions are deployed, prioritizing production systems. Within 7 days, deploy HTTP response validation at network gateways to enforce strict Content-Length compliance and block oversized responses; where possible, migrate affected applications to use incremental callback handlers to eliminate the vulnerability pattern. Within 30 days, establish a monitoring protocol for PJSIP project updates, evaluate replacement libraries with equivalent functionality but without this flaw, and develop a controlled update plan for when vendor patches become available.

PJSIP pjproject CVE-2026-57164

Q: What is the CVSS score of CVE-2026-57164?

CVE-2026-57164 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-71658 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-09-04 GitHub_M

Buffer Overflow Heap Overflow Pjsip Pjproject

8.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network attack via HTTP server response, but MITM or server-control prerequisite warrants AC:H; heap overflow yields no confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 07, 2026 - 15:30 vuln.today

Patch available

Sep 04, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Sep 04, 2026 - 18:05 vuln.today

Analysis Generated

Sep 04, 2026 - 18:05 vuln.today

CVE Published

Sep 04, 2026 - 17:11 cve.org

HIGH 8.3

DescriptionCVE.org

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response; impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally (via on_data_read), or that only connect to trusted servers, are not affected. This issue has been patched via commit 8d5956a.

AnalysisAI

Heap buffer overflow in PJSIP pjproject's PJLIB-UTIL HTTP client allows a malicious or man-in-the-middle HTTP server to corrupt application heap memory or terminate the process by delivering a response body larger than twice the Content-Length-derived initial allocation. The flaw resides in http_client.c where the buffer growth logic performed only a single doubling, which is insufficient when the server-supplied Content-Length substantially underestimates the actual body size, causing pj_memcpy() to write beyond the allocation boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The vulnerable code path is only reachable when an application uses the PJLIB-UTIL HTTP client configured with a whole-body completion callback and no incremental on_data_read callback; applications consuming responses incrementally are explicitly not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) scores 8.3, reflecting network reachability and no privilege requirement, but tempered by the AT:P condition - the attacker must control or man-in-the-middle the HTTP server to which the vulnerable application connects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to apply upstream commit 8d5956afab2ede95ddb199078dc19a8ac0114f3d from the pjproject repository (https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d), which replaces the single-shift buffer growth with a while-loop ensuring the allocated region always fits incoming data before any pj_memcpy() executes. … Detailed patch versions, workarounds, and compensating controls in full report.