CVE-2026-57163 is a critical (CVSS 9.1) stack buffer overflow in PJSIP builds that use GnuTLS, version 2.17 and lower. A crafted certificate triggers it during the TLS handshake. Apply commit c4a151a, or switch to another TLS backend such as OpenSSL.
What's affected
The PJSIP advisory (GHSA-jm2j-6rg6-qvwx) lists versions 2.17 or lower as affected, with no patched release at the time of writing. The patch is commit c4a151a in master.
Only GnuTLS builds are affected, meaning PJSIP configured with the with-gnutls option. OpenSSL and Apple SecureTransport or Network.framework builds are not affected.
The flaw is in tls_cert_get_info in ssl_sock_gtls.c. An incorrect buffer size value lets an oversized Subject Alternative Name entry write past a fixed stack buffer. The certificate can come from a malicious server to a connecting client, or from a malicious client to a server that requests certificates.
How to check if you're exposed
- Find out which TLS backend your PJSIP build uses. Check the build configuration, or the library your binary links with ldd on Linux.
- If GnuTLS is the backend and the PJSIP version is 2.17 or lower, you are affected.
- Check softphones and appliances from vendors that embed PJSIP, and ask them for their backend and fix status.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Rebuild PJSIP with commit c4a151a, or move to a release that includes it once you confirm that.
- Or rebuild with the OpenSSL backend, which the advisory names as a workaround, and test calls and registrations.
- Ask vendors who embed PJSIP for their patch status.
- Where you can, restrict TLS connections to known peers.
- Watch for unexpected crashes of SIP services.
Why it matters
The weakness is CWE-121, stack based buffer overflow. After a handshake the code extracts information from the peer's certificate, and a wrong buffer size lets a long Subject Alternative Name entry overrun a stack buffer. The advisory says the impact ranges from termination of the application to control flow hijack.
It happens during the TLS handshake, before any SIP authentication, so a peer with no credentials can reach it. Certificate fields come from an outside party and must be treated as untrusted input like any other data. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which builds are not affected?
The advisory says OpenSSL and Apple SecureTransport or Network.framework builds are not affected. Only GnuTLS builds are.
Sources
Last reviewed: 19 October 2026.
