{"id":"CVE-2021-37706","details":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.","modified":"2026-04-11T16:26:24.512150Z","published":"2021-12-22T18:15:07.487Z","related":["GHSA-2qpg-f6wf-w984","USN-6422-2"],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5285"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/166225/Asterisk-Project-Security-Advisory-AST-2022-004.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202210-37"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984"},{"type":"FIX","url":"http://seclists.org/fulldisclosure/2022/Mar/0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"0"},{"fixed":"d436f568583184a13aa46349af5a3f0907087b44"},{"introduced":"0"},{"last_affected":"d436f568583184a13aa46349af5a3f0907087b44"},{"introduced":"a65908f83e2f17a3aca7eb39c8e06045aca02674"},{"fixed":"c28961a7d88cf065f693d1ea412c3e2b35e6d18e"},{"introduced":"2c1bba3cbec008c8ce35c78a2c79f9f207ea58bc"},{"fixed":"4cf4f5f7076125bc649727540de5922c21e0558f"},{"introduced":"de4f63b4824c91a0cd9f3d95f3b7923bec71960c"},{"fixed":"7eb4edc725d6fa6877d88129d7bf99c0a1604de9"},{"introduced":"0"},{"last_affected":"847f753c4eda5891c4fe77dd7d0341381cb84975"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"16.8.0"},{"introduced":"0"},{"last_affected":"16.8.0"},{"introduced":"16.0.0"},{"fixed":"16.24.1"},{"introduced":"18.0.0"},{"fixed":"18.10.1"},{"introduced":"19.0.0"},{"fixed":"19.2.1"},{"introduced":"0"},{"last_affected":"10.0"}]}},{"type":"GIT","repo":"https://github.com/pjsip/pjproject","events":[{"introduced":"0"},{"last_affected":"513700f74787009241a11eda125284277f7dfc1c"},{"fixed":"15663e3f37091069b8c98a7fce680dc04bc8e865"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"2.11.1"}]}}],"versions":["10.0.0","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","16.24.0","16.24.0-rc1","16.8.0","16.8.0-rc1","16.8.0-rc2","18.10.0","18.10.0-rc1","19.2.0","19.2.0-rc1","2.10","2.11","2.11.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37706.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert1"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert10"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert11"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert12"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert2"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert3"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert4"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert5"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert6"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert7"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert8"}]},{"events":[{"introduced":"0"},{"last_affected":"16.8.0-cert9"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]}],"vanir_signatures_modified":"2026-04-11T16:26:24Z","vanir_signatures":[{"digest":{"line_hashes":["286375471227338908900759340395951320869","337170165584158815641361604078421931103","218425442522531084557250897674746904437","215575948014480304126719586812745130850"],"threshold":0.9},"source":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865","target":{"file":"pjnath/src/pjnath/stun_msg.c"},"signature_type":"Line","id":"CVE-2021-37706-6c9a95f2","deprecated":false,"signature_version":"v1"},{"digest":{"function_hash":"166111760674862860056573304105766004106","length":452},"source":"https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865","target":{"function":"decode_errcode_attr","file":"pjnath/src/pjnath/stun_msg.c"},"signature_type":"Function","id":"CVE-2021-37706-9e426c0f","deprecated":false,"signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}