CVE-2026-57163

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to commit c4a151a

Description A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. This occurs within the tls cert get info() function in ssl sock gtls.c during the extraction of certificate information following a TLS handshake. An incorrect buffer-size value allows an oversized SubjectAltName entry to be written beyond the boundaries of a fixed-size stack buffer. A network-positioned attacker can trigger this by presenting a crafted certificate, either as a malicious server to a connecting client or as a malicious client to a server requesting certificates, before any SIP-level authentication occurs. This can lead to unexpected application termination, memory corruption, or control flow hijack. Only builds using GnuTLS (--with-gnutls) are affected.

Recommendations Update PJSIP to the version containing commit c4a151a. Restrict the use of GnuTLS builds by using OpenSSL or Apple SecureTransport/Network.framework instead.