CVE-2022-47517

An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.

• CWE-193
• CWE-193

• https://github.com/davehorton/sofia-sip/commit/22c1bd191f0acbf11f0c0fbea1845d9bf9dcd47ePatch, Third Party Advisory
• https://github.com/davehorton/sofia-sip/commit/bfc79d85c8f3a4798a3305fb98f5a11c11d0d29fPatch, Third Party Advisory
• https://github.com/drachtio/drachtio-server/issues/243Exploit, Third Party Advisory
• https://github.com/davehorton/sofia-sip/commit/22c1bd191f0acbf11f0c0fbea1845d9bf9dcd47ePatch, Third Party Advisory
• https://github.com/davehorton/sofia-sip/commit/bfc79d85c8f3a4798a3305fb98f5a11c11d0d29fPatch, Third Party Advisory
• https://github.com/drachtio/drachtio-server/issues/243Exploit, Third Party Advisory

Published

Dec 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47509The SolarWinds Platform was susceptible to the Incorrect Inp…6.1
• CVE-2022-4751The Word Balloon WordPress plugin before 4.19.3 does not val…5.4
• CVE-2022-47512Sensitive information was stored in plain text in a file tha…5.5
• CVE-2022-47514An XML external entity (XXE) injection vulnerability in XML-…8.8
• CVE-2022-47515An issue was discovered in drachtio-server before 0.8.20. It…7.5
• CVE-2022-47516An issue was discovered in the libsofia-sip fork in drachtio…7.5
• CVE-2022-47518An issue was discovered in the Linux kernel before 6.0.11. M…7.8
• CVE-2022-47519An issue was discovered in the Linux kernel before 6.0.11. M…7.8
• CVE-2022-4752The Opening Hours WordPress plugin through 2.3.0 does not va…5.4
• CVE-2022-47520An issue was discovered in the Linux kernel before 6.0.11. M…7.1
• CVE-2022-47521An issue was discovered in the Linux kernel before 6.0.11. M…7.8
• CVE-2022-47522The IEEE 802.11 specifications through 802.11ax allow physic…7.5