CVE-2026-57163 Overview
CVE-2026-57163 is a stack buffer overflow in PJSIP, the open source multimedia communication library maintained by Teluu. The flaw resides in the GnuTLS backend function tls_cert_get_info() inside pjlib/src/pj/ssl_sock_gtls.c. During TLS handshake processing, the code passes an incorrect buffer-size value to gnutls_x509_crt_get_subject_alt_name(), allowing an oversized SubjectAltName entry to overflow a fixed 256-byte stack buffer. Only builds compiled with --with-gnutls are affected. OpenSSL and Apple SecureTransport/Network.framework builds are not vulnerable. The issue was corrected in commit c4a151a.
Critical Impact
A network-positioned attacker presenting a crafted X.509 certificate can trigger memory corruption before any SIP-level authentication, potentially leading to control-flow hijack or process termination.
Affected Products
- Teluu PJSIP (pjproject) versions prior to commit c4a151a
- PJSIP builds compiled with the --with-gnutls option
- Applications embedding vulnerable PJSIP as a SIP/TLS communication library
Discovery Timeline
- 2026-09-04 - CVE-2026-57163 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-57163
Vulnerability Analysis
The vulnerable code path executes after a successful TLS handshake, when PJSIP extracts certificate metadata from the peer for downstream inspection. Inside tls_cert_get_info(), a 256-byte stack buffer named out is used to receive each Subject Alternative Name (SAN) entry returned by gnutls_x509_crt_get_subject_alt_name(). The variable len that governs the maximum copy size is not reset to the true capacity of out on each iteration. Instead, len retains a value from an earlier GnuTLS getter call, where it held sizeof(buf) equal to 512 bytes. GnuTLS then writes up to that stale, larger size into the 256-byte destination when a SAN entry exceeds 256 bytes, corrupting adjacent stack memory. This corruption occurs during connection establishment, before any authentication or authorization check.
Root Cause
The root cause is a size-tracking error classified as a stack-based buffer overflow [CWE-121]. The len in/out parameter passed to GnuTLS was not re-initialized to sizeof(out) - 1 before each call inside the SAN enumeration loop, so the library treated a smaller destination as if it were larger.
Attack Vector
Exploitation is network-based and does not require credentials. A malicious server can serve a crafted certificate to any PJSIP client performing a TLS handshake. Symmetrically, a malicious client can present a crafted certificate to a PJSIP server that requests client authentication. The attacker embeds a SubjectAltName entry longer than 256 bytes, causing bytes beyond the buffer boundary to be written onto the stack.
if (ci->version >= 3) {
char out[256] = { 0 };
/* Get the number of all alternate names so that we can allocate
- * the correct number of bytes in subj_alt_name */
+ * the correct number of bytes in subj_alt_name.
+ *
+ * Pass the true capacity of 'out' as the in/out size argument on
+ * every iteration. 'len' otherwise still holds sizeof(buf) (512)
+ * from an earlier getter, which would let GnuTLS copy an oversized
+ * SubjectAltName entry past the end of the 256-byte 'out' buffer.
+ * Use sizeof(out) - 1 to match the populate loop below, leaving
+ * room for the NUL terminator GnuTLS appends to string names.
+ */
+ len = sizeof(out) - 1;
while (gnutls_x509_crt_get_subject_alt_name(cert, seq, out, &len,
NULL) !=
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
{
seq++;
+ len = sizeof(out) - 1;
}
ci->subj_alt_name.entry = pj_pool_calloc(pool, seq,
// Source: https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78
Detection Methods for CVE-2026-57163
Indicators of Compromise
- Unexpected crashes, aborts, or stack-smashing protector (SSP) messages in processes linking PJSIP with GnuTLS during or immediately after TLS handshakes.
- TLS handshakes presenting X.509 certificates with abnormally long SubjectAltName entries exceeding 256 bytes.
- Repeated inbound or outbound TLS connections from a single peer that consistently terminate the SIP process.
Detection Strategies
- Inspect PJSIP builds and dependencies to confirm whether the --with-gnutls configure flag was used; only these builds are exposed.
- Deploy TLS inspection or packet capture to flag peer certificates containing SAN entries larger than 256 bytes.
- Correlate SIP service crash telemetry with the source IP of the last TLS peer to identify malicious counterparties.
Monitoring Recommendations
- Forward crash dumps and syslog entries from softphones, PBXs, and SIP gateways to a centralized logging platform for correlation.
- Monitor egress TLS connections from client-side SIP applications, which are equally exposed by malicious servers.
- Alert on repeated abnormal terminations of processes that link libpjsip or libpj.
How to Mitigate CVE-2026-57163
Immediate Actions Required
- Update PJSIP to a build that includes commit c4a151a from the pjproject repository.
- Rebuild and redeploy any application that statically links or bundles PJSIP with GnuTLS support.
- Review the GitHub Security Advisory GHSA-jm2j-6rg6-qvwx for release-specific guidance.
Patch Information
The fix reinitializes the len variable to sizeof(out) - 1 before each invocation of gnutls_x509_crt_get_subject_alt_name(), ensuring GnuTLS honors the true capacity of the 256-byte destination buffer. The patch is contained in a single commit to pjlib/src/pj/ssl_sock_gtls.c and preserves room for the trailing NUL terminator that GnuTLS appends to string names.
Workarounds
- Recompile PJSIP against OpenSSL or Apple SecureTransport/Network.framework instead of GnuTLS, since those backends are not affected.
- Restrict TLS peers using firewall rules or SIP trunk allow-lists to limit exposure to attacker-controlled certificates.
- Disable client certificate requests on PJSIP servers where mutual TLS is not required, reducing the server-side attack surface.
# Rebuild PJSIP without the vulnerable GnuTLS backend
./configure --with-ssl=openssl --disable-gnutls
make dep && make clean && make
sudo make install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
