{"id":"CVE-2026-57163","summary":"PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend","details":"PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls); OpenSSL and Apple SecureTransport/Network.framework builds are not affected. While extracting certificate information after a TLS handshake, an incorrect buffer-size value can cause an oversized SubjectAltName entry to be written past the end of a fixed-size stack buffer. A network-positioned attacker presenting a crafted certificate — a malicious server to a connecting client, or a malicious client to a server that requests certificates — can trigger this during the TLS handshake, before any SIP-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. This issue has been patched via commit c4a151a.","aliases":["GHSA-jm2j-6rg6-qvwx"],"modified":"2026-09-06T08:07:53.973653Z","published":"2026-09-04T17:11:40.013Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57163.json","unresolved_ranges":[{"extracted_events":[{"fixed":"c4a151af86fadd16d9480b2603eeb2abf4fb4f78"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57163.json"},{"type":"ADVISORY","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-jm2j-6rg6-qvwx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57163"},{"type":"FIX","url":"https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pjsip/pjproject","events":[{"introduced":"0"},{"fixed":"c4a151af86fadd16d9480b2603eeb2abf4fb4f78"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2.17","2.16","2.15","2.14","2.13","2.12","2.11","2.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57163.json","vanir_signatures_modified":"2026-09-06T08:07:53Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78","target":{"file":"pjlib/src/pj/ssl_sock_gtls.c","function":"tls_cert_get_info"},"deprecated":false,"digest":{"function_hash":"188502425246932374218422840014229499100","length":2309},"id":"CVE-2026-57163-2f37e7f0"},{"deprecated":false,"digest":{"line_hashes":["124120757433032947146882100368131164518","209119722179600850278846081125683827922","242972198365908117749143642779338420715","136202120947234041609691775325918596192","44403053411282909011170079249546239346","276421115470801996193320324908227785548","22343119262153923010491813264015689448","48240597120045865951420096119265919745"],"threshold":0.9},"id":"CVE-2026-57163-e7dc9a28","signature_type":"Line","signature_version":"v1","source":"https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78","target":{"file":"pjlib/src/pj/ssl_sock_gtls.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}