CVE-2026-84975: PJSIP TLS Authentication Bypass Vulnerability

CVE-2026-84975 Overview

PJSIP is a free and open source multimedia communication library written in C, widely used in Session Initiation Protocol (SIP) softphones, gateways, and Voice over IP (VoIP) applications. CVE-2026-84975 affects the OpenSSL and GnuTLS backends in PJSIP 2.17 and earlier, where DNS SubjectAltName (SAN) values are copied using string functions that recalculate length with strlen() and truncate at embedded NUL bytes. This certificate validation flaw enables a server impersonation attack against clients that enable --tls-verify-server for the TLS/SIPS transport. The mbedTLS backend is unaffected because it preserves the explicit ASN.1 string length.

Critical Impact
An attacker holding a certificate issued for target.example\0.attacker.com from a trusted certificate authority can impersonate target.example, complete the SIP session, and capture REGISTER credentials from the victim client.

Affected Products

PJSIP (pjproject) version 2.17 and all earlier releases
PJSIP OpenSSL TLS backend (pjlib/src/pj/ssl_sock_ossl.c)
PJSIP GnuTLS TLS backend (pjlib/src/pj/ssl_sock_gtls.c)

Discovery Timeline

2026-09-18 - CVE-2026-84975 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84975

Vulnerability Analysis

This is an Improper Certificate Validation issue [CWE-295] in the way PJSIP parses X.509 SubjectAltName extensions. When PJSIP extracts DNS SAN entries from a peer certificate, both the OpenSSL and GnuTLS backends invoke pj_strdup2(), which internally applies strlen() to the source buffer. ASN.1 IA5String values, however, carry an explicit length and may legally contain NUL bytes within the payload. Because pj_strdup2() discards the reported length in favor of strlen(), any bytes following an embedded \0 are silently dropped from the stored SAN.

During TLS server verification, PJSIP subsequently compares the target hostname against these truncated SAN entries. A certificate whose SAN is target.example\0.attacker.com is stored as target.example and treated as a valid match for a client connecting to target.example.

Root Cause

The root cause is the use of NUL-terminated C string semantics on data that must be treated as a length-prefixed byte sequence. The OpenSSL backend called pj_strdup2(pool, ..., (char*)p) on the raw ASN.1 payload, and the GnuTLS backend called pj_strdup2() on the out buffer without honoring the returned len. In both cases, the explicit length from the TLS library was available but ignored.

Attack Vector

The attacker must obtain a certificate from a trusted issuer containing a crafted DNS SAN of the form <victim-hostname>\0<attacker-controlled-suffix>. Some public certificate authorities have historically issued such certificates when domain validation only inspects the suffix. The attacker then intercepts the client's TLS/SIPS connection to the victim server through DNS spoofing, BGP hijack, or on-path network position. Because PJSIP truncates the SAN at the NUL byte, verification succeeds, the SIP session completes, and the client transmits its REGISTER credentials to the attacker.

// Patch in pjlib/src/pj/ssl_sock_ossl.c
//                           &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
//                           buf);
//                 } else {
// -                    pj_strdup2(pool,
// -                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
// -                          (char*)p);
// +                    /* Preserve the explicit ASN.1 string length instead of
// +                     * treating the data as a NUL-terminated C string. A DNS
// +                     * SAN such as "host.example\0.attacker" would otherwise be
// +                     * truncated at the embedded NUL, letting a crafted cert be
// +                     * accepted for the prefix hostname (identity bypass).
// +                     */
// +                    pj_str_t tmp;
// +                    pj_strset(&tmp, (char*)p, len);
// +                    pj_strdup_with_null(pool,
// +                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
// +                          &tmp);
// Source: https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd

The fix replaces pj_strdup2() with pj_strset() followed by pj_strdup_with_null(), preserving the length reported by the TLS library.

Detection Methods for CVE-2026-84975

Indicators of Compromise

X.509 certificates observed in TLS handshakes whose DNS SubjectAltName entries contain embedded NUL (0x00) bytes.
Unexpected SIP REGISTER traffic from client endpoints to hosts that are not the configured registrar.
TLS/SIPS sessions terminating at IP addresses inconsistent with authoritative DNS records for the SIP domain.

Detection Strategies

Inspect stored or captured server certificates with an ASN.1-aware parser and flag any SAN whose reported length exceeds the C-string length.
Compare PJSIP-reported peer identity against the full SAN parsed by an independent TLS library such as mbedTLS or Go's crypto/x509.
Correlate SIP registration events with network flow data to identify sessions where the destination host does not match the intended registrar.

Monitoring Recommendations

Enable verbose TLS handshake logging on PJSIP-based clients and forward certificate chains to a central log store for retrospective analysis.
Monitor certificate transparency logs for certificates issued for your SIP hostnames containing suspicious characters or unusually long SAN entries.
Alert on new SIP endpoints establishing TLS sessions to previously unseen IP addresses or autonomous systems.

How to Mitigate CVE-2026-84975

Immediate Actions Required

Inventory all applications, softphones, and gateways that link against pjproject 2.17 or earlier and identify which TLS backend they use.
For OpenSSL and GnuTLS builds, switch to the mbedTLS backend where feasible, as it correctly preserves the ASN.1 string length.
Apply the upstream patch from commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd and rebuild affected binaries from source.
Rotate any SIP account credentials that may have transited untrusted networks while vulnerable clients were in use.

Patch Information

No fixed release version is available as of this review. The upstream fix is available in the pjproject repository. See the PJSIP GitHub Security Advisory GHSA-382p-87mh-r3q8 and the PJSIP patch commit 43d3bd7 for the source-level change.

Workarounds

Build PJSIP against the mbedTLS backend, which is not affected by this issue.
Pin expected server certificates in the client configuration so that certificate substitution by a network-adjacent attacker fails even if SAN validation is bypassed.
Restrict SIP/TLS traffic to trusted network segments and enforce mutual TLS where the infrastructure supports it.

bash

# Rebuild PJSIP against mbedTLS instead of OpenSSL or GnuTLS
./configure --with-ssl=mbedtls --disable-openssl --disable-gnutls
make dep && make clean && make