PatchTheCVECVE-2026-57164: PJSIP is a free and open source multimedia communication library written in C
CVE-2026-57164 is a medium-severity flaw (CVSS 5.9) affecting pjsip. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJLIB-UTIL HTTP client to receive a whole response body at once (a completion callback with no incremental on_data_read callback). When growing the response buffer, an incorrect size calculatio
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 61%) |
| CISA exploited list | No |
| Weakness | CWE-122 |
| Published | 2026-09-04 |
| Last modified | 2026-09-11 |
Last updated 2026-09-11 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-57164?
pjsip: upgrade to newer than 2.17. Exact commands for each OS are on this page.
Is CVE-2026-57164 being exploited?
CVE-2026-57164 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-57164 affect?
CVE-2026-57164 affects pjsip. Severity is medium (CVSS 5.9). PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applicati
How urgent is CVE-2026-57164?
Priority 35/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-40892 CRITICAL 9.8 UPGRADE PJSIP is a free and open source multimedia communication library written in C
- CVE-2026-41415 CRITICAL 9.1 UPGRADE PJSIP is a free and open source multimedia communication library written in C
- CVE-2026-40614 HIGH 8.8 UPGRADE PJSIP is a free and open source multimedia communication library written in C
- CVE-2026-42225 MEDIUM 5.9 UPGRADE PJSIP is a free and open source multimedia communication library written in C
- CVE-2026-41416 HIGH 7.5 UPGRADE PJSIP is a free and open source multimedia communication library written in C