CVE-2026-57164: Teluu Pjsip Buffer Overflow Vulnerability

CVE-2026-57164 Overview

CVE-2026-57164 is a heap buffer overflow [CWE-122] in PJSIP, an open source multimedia communication library written in C. The flaw resides in the PJLIB-UTIL HTTP client (http_client.c) and affects applications that buffer an entire HTTP response body at once using a completion callback without an incremental on_data_read callback. An incorrect size calculation based on the server-supplied Content-Length header can leave the response buffer undersized, causing subsequent writes to overflow the allocation. A malicious or man-in-the-middle HTTP server can trigger the condition with a crafted response, leading to memory corruption or process termination.

Critical Impact
A remote attacker controlling or intercepting HTTP responses can corrupt heap memory in any PJSIP-based application that consumes response bodies non-incrementally.

Affected Products

Teluu PJSIP (pjproject) prior to commit 8d5956a
Applications embedding the PJLIB-UTIL HTTP client with non-incremental response handling
VoIP, SIP, and multimedia clients built on PJSIP that connect to untrusted HTTP servers

Discovery Timeline

2026-09-04 - CVE-2026-57164 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-57164

Vulnerability Analysis

The PJLIB-UTIL HTTP client allocates a response buffer sized using the server-advertised Content-Length value. When more data arrives than the initial allocation can hold, the client grows the buffer by doubling its size. The original logic performed a single doubling, which is insufficient when a delivered body chunk exceeds twice the current allocation. In that scenario, the subsequent pj_memcpy() writes beyond the end of the heap buffer.

A remote HTTP server, whether malicious by intent or acting as an active man-in-the-middle, can supply a small or misleading Content-Length value and then transmit a body larger than twice that value. This condition results in heap corruption inside the PJSIP process. Applications that consume responses incrementally through the on_data_read callback, or that only communicate with trusted servers, are not affected.

Root Cause

The root cause is an incorrect buffer growth calculation. The client trusted a single doubling step to accommodate incoming data and did not loop until the buffer was large enough. A related edge case existed when Content-Length: 0 was returned along with an actual body, leaving the initial allocation at zero and causing any doubling scheme to remain at zero.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker must either operate the HTTP server the victim application contacts or intercept the connection as a man-in-the-middle. The attacker sends a crafted HTTP response with a misleading Content-Length and an oversized body to trigger the overflow.

/* Fixed logic from pjlib-util/src/pjlib-util/http_client.c */
if (hreq->tcp_state.current_read_size + size >
    hreq->response.size)
{
    void *olddata = hreq->response.data;
    pj_size_t new_size = hreq->response.size;

    /* Guard against size==0 (Content-Length: 0 with a body), which
     * would make the doubling loop below spin forever.
     */
    if (new_size == 0)
        new_size = INITIAL_DATA_BUF_SIZE;
    while (hreq->tcp_state.current_read_size + size > new_size)
        new_size <<= 1;

Source: pjproject commit 8d5956a

Detection Methods for CVE-2026-57164

Indicators of Compromise

Unexpected termination or crashes in processes linking against PJSIP when performing HTTP requests.
Heap corruption signatures reported by AddressSanitizer, glibc malloc diagnostics, or Windows Application Verifier in PJSIP-based binaries.
HTTP responses to PJSIP clients where the delivered body size significantly exceeds the advertised Content-Length.

Detection Strategies

Inventory applications and dependencies that statically or dynamically link pjproject and identify those built before commit 8d5956a.
Inspect application code for uses of the PJLIB-UTIL HTTP client that omit the on_data_read callback and rely on completion callbacks for full-body delivery.
Deploy network monitoring to flag HTTP responses containing bodies larger than the declared Content-Length directed at hosts running PJSIP clients.

Monitoring Recommendations

Capture and centralize crash telemetry from PJSIP-linked services to identify heap corruption events.
Alert on outbound HTTP connections from PJSIP applications to untrusted or newly observed external hosts.
Enforce TLS with certificate validation on all HTTP traffic originating from PJSIP components to reduce man-in-the-middle exposure.

How to Mitigate CVE-2026-57164

Immediate Actions Required

Update PJSIP to a build that includes commit 8d5956a and rebuild any application or firmware embedding the library.
Restrict PJSIP HTTP client connections to trusted internal endpoints until the patched version is deployed.
Audit application code that invokes the PJLIB-UTIL HTTP client and prefer incremental on_data_read handling where feasible.

Patch Information

The issue is fixed in pjproject commit 8d5956a. Downstream projects should pull the corrected http_client.c growth logic, which loops the doubling operation until the buffer accommodates the incoming data and guards against a zero-sized initial allocation. Additional context is available in the GitHub Security Advisory GHSA-59fr-724j-6fjv.

Workarounds

Refactor callers to use the on_data_read incremental callback, which is not affected by the vulnerable buffering path.
Configure applications to communicate only with trusted HTTPS endpoints and enforce strict certificate validation to prevent man-in-the-middle response injection.
Apply network egress controls that limit PJSIP hosts to a known allowlist of HTTP endpoints.

bash

# Rebuild pjproject at the patched commit
git clone https://github.com/pjsip/pjproject.git
cd pjproject
git checkout 8d5956afab2ede95ddb199078dc19a8ac0114f3d
./configure && make dep && make
sudo make install