CVE-2023-27585

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-14 · updated 2026-06-17
Weakness: CWE-120

Description

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

Affected products

teluu pjsip: before 2.13 — fixed in 2.13

How to fix

Upgrade to a fixed version: teluu pjsip 2.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-27585 or the next vulnerability affects your stack