CVE-2026-84975

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_ossl.c and pjlib/src/pj/ssl_sock_gtls.c copy DNS SubjectAltName values with string functions that recalculate their length and truncate an embedded NUL byte. With server verification enabled through --tls-verify-server for the PJSIP TLS/SIPS transport, a certificate containing a DNS SubjectAltName formed from the target hostname prefix followed by an embedded NUL and an attacker-controlled suffix can therefore be accepted for the prefix hostname. An attacker who possesses such a certificate from a trusted issuer and can intercept the connection can impersonate the target server, complete the SIP session, and receive REGISTER credentials. The mbedTLS backend is not affected because it preserves the explicit string length. No fixed version is available as of this review.

• CWE-295
• CWE-297

• https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd
• https://github.com/pjsip/pjproject/security/advisories/GHSA-382p-87mh-r3q8

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84967A component of the MongoDB extension for Visual Studio Code …4.3
• CVE-2026-84968An out-of-bounds read in the BSON decoding component of the …5.3
• CVE-2026-84969A memory-handling error in the BSON-to-JSON conversion helpe…3.7
• CVE-2026-8497Improper certificate validation in the Devolutions Server co…7.4
• CVE-2026-84970A numeric truncation weakness exists in the JSON parsing com…5.8
• CVE-2026-84971Improper handling of an unexpected value size in the decrypt…6.5
• CVE-2026-84989ntopng is a web-based network traffic monitoring application…7.1
• CVE-2026-8499The Helpfulcrowd Product Reviews plugin for WordPress is vul…5.3
• CVE-2026-84990ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-84992md-editor-v3 is a Markdown editor for Vue 3 developed in JSX…6.1
• CVE-2026-84993MikroORM is a TypeScript ORM for Node.js based on Data Mappe…6.5
• CVE-2026-84997react/http is an event-driven, streaming HTTP client and ser…7.5