CVE-2022-23537

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).

• CWE-122
• CWE-125

• https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26wPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.htmlMailing List, Third Party Advisory
• https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26wPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html

Published

Dec 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2353Prior to microweber/microweber v1.2.20, due to improper neut…6.1
• CVE-2022-23530GuardDog is a CLI tool to identify malicious PyPI packages. …6.5
• CVE-2022-23531GuardDog is a CLI tool to identify malicious PyPI packages. …7.8
• CVE-2022-23532APOC (Awesome Procedures on Cypher) is an add-on library for…6.5
• CVE-2022-23535LiteDB is a small, fast and lightweight .NET NoSQL embedded …9.8
• CVE-2022-23536Cortex provides multi-tenant, long term storage for Promethe…6.5
• CVE-2022-23538github.com/sylabs/scs-library-client is the Go client for th…7.6
• CVE-2022-23539Versions `<=8.5.1` of `jsonwebtoken` library could be miscon…8.1
• CVE-2022-2354The WP-DBManager WordPress plugin before 2.80.8 does not pre…7.2
• CVE-2022-23540In versions `<=8.5.1` of `jsonwebtoken` library, lack of alg…7.6
• CVE-2022-23541jsonwebtoken is an implementation of JSON Web Tokens. Versio…6.3
• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8