CVE-2026-32945 is a critical heap buffer overflow in the PJSIP DNS parser, scored CVSS 9.8. It affects applications that use PJSIP's built-in DNS resolver, versions 2.16 and below. PJSIP 2.17 fixes it, and apps that use the operating system resolver are not affected.
What's affected
The GitHub advisory lists PJSIP 2.16 or lower as affected, with 2.17 as the patched version. It says a fuzzer found the overflow in the DNS parser's name length handler.
Only some users are exposed. The advisory says the issue affects applications that use PJSIP's DNS resolver, for example PJSUA or PJSUA2 configured with a nameserver through pjsua_config.nameserver or UaConfig.nameserver. It does not affect those who leave the nameserver unset so the library uses the OS resolver, or who use an external resolver set by pjsip_resolver_set_ext_resolver().
How to check if you're exposed
Find the PJSIP version your product ships. For a system library:
pkg-config --modversion libpjproject
Many products bundle PJSIP inside their own binaries, so also check the vendor's documentation or bill of materials.
Then check configuration for a nameserver setting in PJSUA or PJSUA2 code, and for calls to the external resolver function. If you set a nameserver, the built-in resolver is active and the bug applies.
What to do now
- Upgrade PJSIP to 2.17 or later and rebuild applications that bundle it.
- If you cannot upgrade, apply the advisory workaround: set nameserver_count to zero to disable DNS resolution in PJSIP, or use an external resolver implementation.
- Prefer the operating system resolver where your design allows it.
- Ask vendors of VoIP products, softphones and gateways whether they embed PJSIP and which version.
- Add PJSIP to your component inventory so bundled copies are visible.
Finding PJSIP is often the hard part. It is embedded in softphones, SIP gateways, conferencing tools and embedded devices, and it may be statically linked, so a package scan can miss it. Ask each vendor, check their bill of materials, and search binaries for PJSIP version strings if you have to.
The advisory says a fuzzer named fuzz-dns-records found the overflow, and that the patch is commit 5311aee on the master branch, released in 2.17. Fuzzing parsers that take network input is how many of these bugs surface, which is a reason to keep the resolver's attack surface small by using the OS resolver where you can.
Why it matters
The class is CWE-122, heap based buffer overflow. A parser trusted a length value from the network and wrote past the end of its buffer. DNS replies come from outside the process, so the data that feeds the parser is attacker influenced when the network is not trusted.
The score is 9.8 because memory corruption in a network parser can lead to crashes and in some cases code execution, and no login is needed. The advisory is limited in scope because only the built-in resolver is affected. PJSIP is embedded in many communications products, so the hard part is often finding where it hides. The record's KEV flag is false.
Quick check
I use PJSUA2 but never set a nameserver. Am I exposed?
The advisory says not setting the nameserver, so the OS resolver is used, avoids the issue. Upgrade anyway when you can.
Sources
Last reviewed: 19 October 2026.
