Critical Buffer Overflow Vulnerability in PJSIP Library (pjproject)

pjproject Updated 02 Oct 2025

Summary

09/06/2022

Disclosed on

N/A

Severity

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

ALPINE-CVE-2022-31031: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Affects pjproject versions < 2.13-r0. Fixed in 2.13-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

PJSIP is a free and open-source multimedia communication library written in C that implements standard-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. It is widely used for building communication applications due to its robust features and flexibility. However, certain versions of PJSIP are vulnerable to a stack buffer overflow, particularly affecting users who utilize STUN in their applications.

Vulnerability Detail

The vulnerability arises from a stack buffer overflow in PJSIP versions prior to and including 2.12.1. This issue affects users who configure a STUN server in their account/media settings or directly use the 'pjlib-util/stun_simple' API. If exploited, this vulnerability can lead to severe consequences, including unauthorized access, data corruption, or application crashes. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature.

How To Fix

Minimum fixed version

2.13-r0

This is the first release that contains the fix.

sudo apk add --upgrade pjproject

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

Currently, there are no known workarounds for this vulnerability. It is recommended to update to the fixed version as soon as possible to mitigate risks.

Conclusion

The buffer overflow vulnerability in the PJSIP library poses a significant risk to applications utilizing STUN. It is crucial for developers to update to the patched version 2.13-r0 or later to safeguard their applications against potential exploits. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.

See every vulnerability recorded for pjproject →