CVE-2026-57164: CWE-122: Heap-based Buffer Overflow in pjsip pjproject

PJSIP pjproject contains a heap buffer overflow in the PJLIB-UTIL HTTP client (http_client.c) when buffering a complete HTTP response body in one operation without incremental processing. The vulnerability arises from an incorrect buffer size calculation using the server-supplied Content-Length header, which can cause the buffer to be undersized and lead to writing beyond allocated memory. A malicious or man-in-the-middle HTTP server can exploit this by sending a crafted response. The impact ranges from application crashes to memory corruption. The issue was fixed in commit 8d5956a.

Exploitation can lead to unexpected application termination or memory corruption, which may affect the stability and security of applications using the vulnerable PJLIB-UTIL HTTP client. The vulnerability requires an attacker to control or intercept HTTP responses to trigger the overflow. Applications that process response data incrementally or connect only to trusted servers are not vulnerable.

This vulnerability has been patched in commit 8d5956a. Users and developers should update to the fixed version incorporating this commit. Applications that consume HTTP responses incrementally or restrict connections to trusted servers are not affected. No additional mitigation is required if the patch is applied.