CVE-2022-21723: Out-of-bounds read in multipart parsing in PJSIP

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-27 · updated 2026-06-17
Weakness: CWE-125

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Affected products

asterisk Certified Asterisk: 16.8.0, 16.8.0-cert1, 16.8.0-cert10, 16.8.0-cert11, 16.8.0-cert12, 16.8.0-cert2 (+7)
Debian Linux: 9.0, 10.0
asterisk: from 16.0.0 before 16.24.1; from 18.0.0 before 18.10.1; from 19.0.0 before 19.2.1 — fixed in 16.24.1, 18.10.1, 19.2.1
teluu pjsip: through 2.11.1

How to fix

Upgrade to a fixed version: asterisk 16.24.1, 18.10.1, 19.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21723 or the next vulnerability affects your stack