CVE-2021-32686

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.11.1

Description The issue is related to the SSL socket in PJSIP, a free and open source multimedia communication library. It involves a race condition between callback and destroy due to the accepted socket having no group lock, and the SSL socket parent/listener may get destroyed during handshake. These issues occur intermittently in heavy load TLS connections and cause a crash, resulting in a denial of service.

Recommendations For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider restricting the use of heavy load TLS connections to minimize the risk of exploitation.