CVE-2026-57164

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to commit 8d5956a

Description A heap buffer overflow occurs in the PJLIB-UTIL HTTP client within the http client.c file when buffering an HTTP response body. This issue affects applications that receive a complete response body at once using a completion callback without an incremental on data read callback. The flaw stems from an incorrect size calculation based on the server-supplied Content-Length, which can result in a buffer that is too small, allowing response data to be written beyond the allocated memory. A malicious or man-in-the-middle HTTP server can trigger this by sending a crafted response, potentially leading to memory corruption or unexpected application termination.

Recommendations Update PJSIP to the version containing commit 8d5956a. As a temporary mitigation, avoid using the PJLIB-UTIL HTTP client to receive whole response bodies at once and instead consume responses incrementally via the on data read callback. Restrict connections to trusted servers only.