CVE-2026-57164 pjsip CVE debrief

Who should care

Defenders and developers of applications using the PJLIB-UTIL HTTP client, especially those consuming responses incrementally or connecting to untrusted servers, should assess exposure and prioritize patching or mitigation.

Why it matters

Defenders should care about CVE-2026-57164 because it affects applications using the PJLIB-UTIL HTTP client, potentially leading to unexpected termination or memory corruption. Verification of exposure and patching or mitigation is necessary.

• Unexpected application termination due to crafted responses
• Memory corruption due to buffer overflow
• Verification of affected versions and exposure is required
• Patching or mitigation is necessary to prevent exploitation

Technical summary

The PJLIB-UTIL HTTP client is vulnerable to a heap buffer overflow when buffering an HTTP response body. This occurs when growing the response buffer with an incorrect size calculation based on the server-supplied Content-Length, leaving the buffer too small. The vulnerability can be triggered by a malicious or man-in-the-middle HTTP server with a crafted response. Impact may range from unexpected application termination to memory corruption. Applications that consume the response incrementally or connect to trusted servers are not affected.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for applications that consume the response incrementally or connect to untrusted servers.

Recommended defensive actions

• Patch or update to a fixed version of PJSIP
• Review and update affected applications to use incremental response handling
• Verify and limit connections to trusted servers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The PJLIB-UTIL HTTP client is vulnerable to a heap buffer overflow when buffering an HTTP response body. The vulnerability has been patched via commit 8d5956a. There is no information on known or unknown affected scope. Defenders should verify affected versions and exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.