PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a
    stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest
    credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as
    the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if
    data.slen exceeds the expected digest string length. (CVE-2026-40892)

  - PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a
    buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively
    long usernames. (CVE-2026-25994)

  - PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical
    heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed
    H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic
    that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the
    issue. (CVE-2026-26203)

  - PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below,
    there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs
    when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without
    validating that both bytes are within the payload buffer bounds. The vulnerability affects applications
    that receive video using H.264. A patch is available at
    https://github.com/pjsip/pjproject/commit/f821c214e52b11bae11e4cd3c7f0864538fb5491. (CVE-2026-26967)

  - PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a
    heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is
    triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in
    version 2.17. (CVE-2026-28799)

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4631 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4631-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     June 16, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : asterisk     Version        : 1:16.28.0~dfsg-0+deb11u10     CVE ID         : CVE-2025-65102 CVE-2026-25994 CVE-2026-26203                      CVE-2026-26967 CVE-2026-28799 CVE-2026-29068                      CVE-2026-32942 CVE-2026-32945 CVE-2026-33069                      CVE-2026-34235 CVE-2026-40614 CVE-2026-41415                      CVE-2026-42225


    Several issues have been found in asterisk, an Open Source Private Branch     Exchange (PBX). They are related to buffer under- or overflows, either on     heap or on stack. Some are related to use-after-free or wrong processing     of invalid or untrusted certificates.



    For Debian 11 bullseye, these problems have been fixed in version     1:16.28.0~dfsg-0+deb11u10.

    We recommend that you upgrade your asterisk packages.

    For the detailed security status of asterisk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/asterisk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8122-1 advisory.

    Youngsung Kim discovered that PJSIP did not properly parse numeric header fields in SIP messages. A remote     attacker could use this issue to cause PJSIP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-16872)

    Peter Koletzki discovered that PJSIP did not properly handle certain connection requests. A remote     attacker could possibly use this issue to cause PJSIP to enter an unrecoverable state and reject further     connections, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-16875)

    Alfred Farrugia, Sandro Gauci, and Kevin Harwell discovered that PJSIP did not properly parse certain SDP     messages. A remote attacker could possibly use this issue to cause PJSIP to crash, resulting in a denial     of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1000098, CVE-2018-1000099)

    Lauri Vnsk discovered that PJSIP did not verify hostnames when reusing TLS connections. If a remote     attacker were able to intercept communication, this flaw could possibly be exploited to view sensitive     information. (CVE-2020-15260)

    It was discovered that PJSIP did not properly handle certain sequences of SDP messages. A remote attacker     could possibly use this issue to cause PJSIP to crash, resulting in a denial of service. (CVE-2021-21375)

    It was discovered that the SSL socket implementation in PJSIP contained a race condition. A remote     attacker could possibly use this issue to cause PJSIP to crash, resulting in a denial of service. This     issue was only addressed in Ubuntu 18.04 LTS. (CVE-2021-32686)

    It was discovered that PJSIP did not properly parse certain STUN messages. A remote attacker could use     this issue to cause PJSIP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2021-37706)

    Uriya Yavnieli discovered that PJSIP did not properly manage memory under certain conditions. A remote     attacker could use this issue to cause PJSIP to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, CVE-2021-43303)

    It was discovered that PJSIP did not properly manage memory when processing ICE session credentials. A     remote attacker could use this issue to cause PJSIP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2026-25994)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
444415	Alpine: multiple pjproject packages: security update to 2.17-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
444415	Alpine: multiple pjproject packages: security update to 2.17-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
321215	Debian dla-4631 : asterisk - security update	Nessus	Debian Local Security Checks	critical
303754	Ubuntu 16.04 LTS / 18.04 LTS : PJSIP vulnerabilities (USN-8122-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2026-25994

critical

Tenable Plugins

critical

critical

critical

critical