CVE-2022-23547

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.

• CWE-122
• CWE-125

• https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26wPatch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7frPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26wPatch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7frPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html

Published

Dec 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23540In versions `<=8.5.1` of `jsonwebtoken` library, lack of alg…7.6
• CVE-2022-23541jsonwebtoken is an implementation of JSON Web Tokens. Versio…6.3
• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8
• CVE-2022-23543Silverware Games is a social network where people can play g…5.4
• CVE-2022-23544MeterSphere is a one-stop open source continuous testing pla…6.1
• CVE-2022-23546In version 2.9.0.beta14 of Discourse, an open-source discuss…5.5
• CVE-2022-23548Discourse is an option source discussion platform. Prior to …6.5
• CVE-2022-23549Discourse is an option source discussion platform. Prior to …6.5
• CVE-2022-2355The Easy Username Updater WordPress plugin before 1.0.5 does…6.5
• CVE-2022-23551aad-pod-identity assigns Azure Active Directory identities t…5.3
• CVE-2022-23552Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-23553Alpine is a scaffolding library in Java. Alpine prior to ver…7.5