CVE-2022-24793

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record `parse_rr()`, while the issue in CVE-2023-27585 is in `parse_query()`. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver instead.

• CWE-120
• CWE-120

• https://github.com/pjsip/pjproject/commit/9fae8f43accef8ea65d4a8ae9cdf297c46cfe29aPatch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00047.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory
• https://github.com/pjsip/pjproject/commit/9fae8f43accef8ea65d4a8ae9cdf297c46cfe29aPatch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/05/msg00047.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory

Published

Apr 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24788Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2022-24789C1 CMS is an open-source, .NET based Content Management Syst…7.6
• CVE-2022-2479Insufficient validation of untrusted input in File in Google…4.3
• CVE-2022-24790Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 se…7.5
• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8
• CVE-2022-24797Pomerium is an identity-aware access proxy. In distributed s…9.1
• CVE-2022-24798Internet Routing Registry daemon version 4 is an IRR databas…7.5
• CVE-2022-24799wire-webapp is the web application interface for the wire me…6.1