CVE-2021-43845

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size.

• CWE-125
• CWE-125

• https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/pull/2924Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hhPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory
• https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/pull/2924Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hhPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory

Published

Dec 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4384The WordPress Photo Gallery – Image Gallery plugin for WordP…4.3
• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5
• CVE-2021-43841XWiki is a generic wiki platform offering runtime services f…5.4
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43846`solidus_frontend` is the cart and storefront for the Solidu…4.3
• CVE-2021-43847HumHub is an open-source social network kit written in PHP. …6.5
• CVE-2021-43848h2o is an open source http server. In code prior to the `8c0…5.9
• CVE-2021-43849cordova-plugin-fingerprint-aio is a plugin provides a single…5.5
• CVE-2021-4385The WP Private Content Plus plugin for WordPress is vulnerab…4.3
• CVE-2021-43850Discourse is an open source platform for community discussio…6.8