{"kind": "product", "path": "vulns/debian-14/asterisk", "name": "asterisk", "product": "asterisk", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-84975", "noindex": false, "published": "2026-09-18T17:08:33.140Z", "modified": "2026-09-24T21:05:26.112Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-84975", "title": "PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_ossl.c and pjlib/src/pj/ssl_sock_gtls.c copy DNS SubjectAltName values with string functions that recalculate their length and truncate an embedded NUL byte. With server verification enabled through --tls-verify-server for the PJSIP TLS/SIPS transport, a certificate containing a DNS SubjectAltName formed from the target hostname prefix followed by an embedded NUL and an attacker-controlled suffix can therefore be accepted for the prefix hostname. An attacker who possesses such a certifica", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-382p-87mh-r3q8", "https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd", "https://nvd.nist.gov/vuln/detail/CVE-2026-84975"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-77396", "noindex": false, "published": "2026-09-18T17:07:50.209Z", "modified": "2026-09-21T20:49:26.187Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00116, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77396", "title": "PJSIP: Heap buffer overflow in the AVI parser", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept ", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-6p2p-5wf8-h5hr", "https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f", "https://nvd.nist.gov/vuln/detail/CVE-2026-77396"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57166", "noindex": false, "published": "2026-09-04T17:12:10.146Z", "modified": "2026-09-09T16:03:18.916Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00533, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57166", "title": "PJSIP: Pre-authentication overflow in the telnet CLI error", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amount of data into fixed-size buffers without sufficient bounds checking, so a long command line can overflow them. This affects only applications that enable the telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet-port). The telnet CLI is an interactive administration interface with no authentication, so any client able to reach it can alrea", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-9c8q-h38q-p85j", "https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1", "https://nvd.nist.gov/vuln/detail/CVE-2026-57166"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57165", "noindex": false, "published": "2026-09-04T17:12:01.043Z", "modified": "2026-09-08T17:33:28.409Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00452, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57165", "title": "PJSIP: Pre-authentication overflow in the telnet CLI history", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet.c). This affects only applications that enable the telnet CLI front-end (same gating as the related CLI issue). The line-redraw sequence for a recalled history entry can accumulate more data than a fixed-size stack buffer holds, which may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the a", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-rpq9-9fx7-95xw", "https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6", "https://nvd.nist.gov/vuln/detail/CVE-2026-57165"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57164", "noindex": false, "published": "2026-09-04T17:11:55.615Z", "modified": "2026-09-08T17:39:29.425Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00451, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57164", "title": "PJSIP: Heap overflow in the HTTP client", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculation based on the server-supplied Content-Length can leave the buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigg", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-59fr-724j-6fjv", "https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d", "https://nvd.nist.gov/vuln/detail/CVE-2026-57164"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57163", "noindex": false, "published": "2026-09-04T17:11:40.013Z", "modified": "2026-09-04T17:25:49.678Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00402, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57163", "title": "PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted ", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-jm2j-6rg6-qvwx", "https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78", "https://nvd.nist.gov/vuln/detail/CVE-2026-57163"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57162", "noindex": false, "published": "2026-09-04T17:11:37.114Z", "modified": "2026-09-04T17:26:19.175Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00638, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57162", "title": "PJSIP: Stack overflow parsing SDP a=crypto attributes", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on t", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-m9g3-jcj8-qjfm", "https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9", "https://nvd.nist.gov/vuln/detail/CVE-2026-57162"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57161", "noindex": false, "published": "2026-09-04T17:11:33.488Z", "modified": "2026-09-09T17:48:15.707Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57161", "title": "PJSIP: Stack overflow handling Service-Route headers in a registration response", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affects applications that register using the PJSUA/PJSUA2 account API (the default registration path). The Service-Route URIs from a 2xx response to REGISTER are stored into a fixed-size array without bounding the number of headers; a registrar that returns an excessive number of Service-Route headers can write past the end of the array on the stack. The values written are internal pointers r", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-xc62-j9h2-mp84", "https://github.com/pjsip/pjproject/commit/acc03b57cef7a7d31b8e1f5b9117437d7e87c591", "https://nvd.nist.gov/vuln/detail/CVE-2026-57161"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57160", "noindex": false, "published": "2026-09-04T17:11:29.344Z", "modified": "2026-09-08T17:33:34.357Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57160", "title": "PJSIP: SIP message header buffer overflow", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the function that serializes generic array headers (such as Allow, Require, Supported, and Unsupported). Under certain output-buffer boundary conditions the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests — for example a proxy, SBC, or B2BUA — where a remote peer can influence the serialized message. The out-of-bounds write is a single fixed byte; code", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-277r-3q2j-mxcw", "https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c", "https://nvd.nist.gov/vuln/detail/CVE-2026-57160"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-57159", "noindex": false, "published": "2026-09-04T17:11:26.957Z", "modified": "2026-09-08T17:36:39.574Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00596, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-57159", "title": "PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign_pt_and_update_map() in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken from a remote SDP offer or answer to index fixed-size internal tables without sufficient bounds validation, so a crafted remote SDP can cause memory access outside those tables. The practical impact is memory corruption and denial of service; code execution is not demonstrated. This path is only reached when PJMEDIA_S", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-rfwg-w9gq-9mw2", "https://github.com/pjsip/pjproject/commit/673b978aab1fe3ab874247be32c871acc880cbeb", "https://nvd.nist.gov/vuln/detail/CVE-2026-57159"], "fixes": [], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-42225", "noindex": false, "published": "2026-05-07T18:47:26.563Z", "modified": "2026-05-08T14:18:36.257Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00161, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42225", "title": "GnuTLS backend silently skips certificate chain verification when verify_peer is false", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx", "https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920", "https://github.com/pjsip/pjproject/releases/tag/2.17"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-41416", "noindex": false, "published": "2026-04-24T18:40:08.349Z", "modified": "2026-04-27T13:35:20.030Z", "cvss": 8.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "high", "epss": 0.00279, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-41416", "title": "PJSIP: Asymmetric ptime integer overflow in Media Stream", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can lead to unexpected application termination or memory corruption This vulnerability is fixed in 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-f33g-8hjq-62xr", "https://github.com/pjsip/pjproject/commit/66fe416c96e957417621b7be16e9e587d159f9bb", "https://nvd.nist.gov/vuln/detail/CVE-2026-41416"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-41415", "noindex": false, "published": "2026-04-24T18:38:36.181Z", "modified": "2026-04-24T19:58:40.628Z", "cvss": 6.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "medium", "epss": 0.00308, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-41415", "title": "PJSIP: SIP Multipart CID URI Length Underflow", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when parsing a malformed Content-ID URI in SIP multipart message body. Insufficient length validation can cause reads beyond the intended buffer bounds. This vulnerability is fixed in 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-935m-fmf5-j4pm", "https://github.com/pjsip/pjproject/commit/4225a93c16661538005017883fbc8f1ea1d5f4b0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41415"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-40892", "noindex": false, "published": "2026-04-21T19:55:26.876Z", "modified": "2026-04-21T20:27:29.133Z", "cvss": 8.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "severity": "high", "epss": 0.00419, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40892", "title": "PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-2wcg-w3c4-48r7", "https://github.com/pjsip/pjproject/commit/c82123ea6f3c3652bbc9ebd5e9e658c301451687", "https://nvd.nist.gov/vuln/detail/CVE-2026-40892"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-40614", "noindex": false, "published": "2026-04-21T18:04:15.159Z", "modified": "2026-04-22T13:33:23.816Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00224, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-40614", "title": "PJSIP: Heap buffer overflow in Opus codec decoding", "description": "PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields only 960 bytes, but codec_parse() can output encoded frames up to MAX_ENCODED_PACKET_SIZE (1280) bytes via opus_repacketizer_out_range(). The three pj_memcpy() calls in codec_decode() copied input->size bytes without bounds checking, causing a heap buffer over", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-j59p-4xrr-fp8g", "https://github.com/pjsip/pjproject/commit/17897e835818f8ee03b1806ddcd7b95ea16d2c0e", "https://nvd.nist.gov/vuln/detail/CVE-2026-40614"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-34235", "noindex": false, "published": "2026-03-31T15:36:47.466Z", "modified": "2026-04-02T15:20:55.954Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34235", "title": "PJSIP: Heap OOB read in VPX unpacketizer", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap out-of-bounds read vulnerability exists in PJSIP's VP9 RTP unpacketizer that occurs when parsing crafted VP9 Scalability Structure (SS) data. Insufficient bounds checking on the payload descriptor length may cause reads beyond the allocated RTP payload buffer. This issue has been patched in version 2.17. A workaround for this issue involves disabling VP9 codec if not needed.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-pqrm-53pc-wx28", "https://github.com/pjsip/pjproject/commit/f4c7d08211da1fe2ad1504434a0ad99d12aa7536", "https://nvd.nist.gov/vuln/detail/CVE-2026-34235"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-33069", "noindex": false, "published": "2026-03-20T08:21:51.442Z", "modified": "2026-03-20T15:34:38.179Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00265, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33069", "title": "PJSIP has an Out-of-bounds Read in SIP multipart parsing", "description": "PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP messages with multipart bodies or SDP content are potentially affected. This issue is resolved in version 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-x5pq-qrp4-fmrj", "https://github.com/pjsip/pjproject/commit/f0fa32a226df5f87a9903093e5d145ebb69734db", "https://nvd.nist.gov/vuln/detail/CVE-2026-33069"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-32945", "noindex": false, "published": "2026-03-20T03:54:00.813Z", "modified": "2026-03-20T14:28:15.761Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0032, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32945", "title": "PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser", "description": "PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsip_resolver_set_ext_resolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-jr2p-p2w4-rr9q", "https://github.com/pjsip/pjproject/commit/5311aee398ae9d623829a6bad7b679a193c9e199", "https://nvd.nist.gov/vuln/detail/CVE-2026-32945"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-32942", "noindex": false, "published": "2026-03-20T03:43:37.112Z", "modified": "2026-03-20T18:08:20.801Z", "cvss": 8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "high", "epss": 0.00332, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32942", "title": "PJSIP has ICE session use-after-free race conditions", "description": "PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a  heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-g88q-c2hm-q7p7", "https://github.com/pjsip/pjproject/issues/1451", "https://github.com/pjsip/pjproject/commit/c9caceddabda7f18337b2a82d25d65f6224b450a"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-28799", "noindex": false, "published": "2026-03-06T06:36:55.109Z", "modified": "2026-03-09T19:50:33.494Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00296, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28799", "title": "PJSIP: Heap use-after-free in PJSIP presence subscription termination handler", "description": "PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.", "references": ["https://github.com/pjsip/pjproject/security/advisories/GHSA-8fj4-fv9f-hjpc", "https://github.com/pjsip/pjproject/commit/e06ff6c64741cc1675fd3296615910f532f6b1a1", "https://nvd.nist.gov/vuln/detail/CVE-2026-28799"], "fixes": ["1:22.10.0+dfsg+~cs6.17.60671434-1"], "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}]}], "total": 209, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 11, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "asterisk", "path": "vulns/debian-14/asterisk", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-24T21:05:26.112Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}