CVE-2026-57164

Executive Summary

CVE-2026-57164 is a heap buffer overflow (CWE-122) in the PJLIB-UTIL HTTP client component of PJSIP, a widely used open-source multimedia communication library written in C. The flaw affects applications that consume a full HTTP response body at once via a completion callback (rather than incrementally via on_data_read); an incorrect size calculation based on a server-supplied Content-Length header can leave the internal response buffer too small, causing response data to be written past the end of the allocation. A malicious or man-in-the-middle HTTP server can trigger this with a crafted response, with impact ranging from unexpected application termination (denial of service) to memory corruption. The issue is scored CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and has been patched in commit 8d5956a.

Technical Analysis

PJSIP is a free and open source multimedia communication library written in C, commonly used for SIP/VoIP stacks and embedded/unified communications products. Within the library, the PJLIB-UTIL HTTP client (http_client.c) performs HTTP requesting and response buffering on behalf of applications.

The vulnerability class is a heap-based buffer overflow (CWE-122). It manifests specifically in the code path responsible for buffering an entire HTTP response body in a single operation — that is, when an application registers a completion callback with no incremental on_data_read callback. In this mode, the client allocates and grows a response buffer.

When the client grows the response buffer, it performs a size calculation that incorporates the server-supplied Content-Length header. Per the NVD description, this calculation is incorrect: it "can leave the buffer too small." Because the value fed into the calculation is attacker-controlled (the HTTP server dictates Content-Length), a crafted response can cause the client to allocate less memory than is required to hold the body. Response data is then written past the end of the allocation, producing a heap overflow.

Attack surface and preconditions:

• Network-reachable: CVSS AV:N — the malicious server is reached over the network.
• Attack complexity High (AC:H): successful triggering depends on the crafted response interacting with the size-calculation logic in the affected buffering mode; not a trivial, fully deterministic condition.
• No privileges (PR:N) and no user interaction (UI:N) required on the client side.
• Scope unchanged (S:U), with no confidentiality or integrity impact (C:N/I:N) but High availability impact (A:H) — consistent with a memory-safety fault that primarily manifests as crash/termination, with the potential for worse.

Notably, per the description, applications that consume the response incrementally via on_data_read are not affected, nor are applications that only connect to trusted servers. This sharply narrows the vulnerable population: the exposure is concentrated in code that (a) fully buffers responses using the no-on_data_read completion path and (b) makes HTTP requests to servers that an attacker can influence (untrusted, third-party, or MITM-accessible endpoints).

The specific arithmetic error, allocation-growth logic, and the exact relationship between Content-Length and the computed buffer size are not described in the provided NVD text; a precise code-level root cause cannot be stated here without the patch diff. The public remediation is commit 8d5956a, and the root cause should be confirmed by reviewing that commit.

Exploitation Scenarios

No public PoC or exploit code is available, and no exploit-in-the-wild evidence is recorded. The following chain is inferred strictly from the vulnerability class and the NVD description.

1) Reconnaissance / target identification. The attacker identifies an application that embeds PJSIP and uses the PJLIB-UTIL HTTP client to fetch whole response bodies (completion callback, no incremental on_data_read), from a server the attacker can serve or intercept. Footprinting targets SIP/VoIP endpoints, embedded appliances, or clients that pull HTTP resources from configurable or third-party origins. Note that, as a library, PJSIP does not advertise itself in HTTP responses by default; identification is best accomplished by network fingerprinting of the surrounding application, Shodan queries against exposed services (e.g., SIP on port 5060), or by knowing the target's software stack.

2) Triggering the flaw (vulnerability class). The attacker arranges for the victim client to issue an HTTP request to an attacker-controlled (or MITM-visible) HTTP server and returns a crafted response whose Content-Length interacts with the client's incorrect size calculation so that the growth step under-allocates. The subsequent body data is written past the end of the heap allocation. No specific request/response byte layout can be given here, because the precise error is not described in the provided data.

3) Payload / execution method (class level). At the vulnerability-class level, this is a heap overflow reached through a crafted network response body. The mechanism does not require any client-side callback or user action; it is triggered by the client's own buffering routine processing attacker-influenced response data. Because the exact overflow is driven by a size mismatch, the practical trigger methods at the class level are a malformed or misleading Content-Length and/or body content that exceeds what the under-sized buffer can hold. (No specific payload construction is documented and none is asserted here.)

4) Post-exploitation impact. Per the NVD description, impact "may range from unexpected application termination to memory corruption." The availability-focused CVSS profile (A:H, C:N/I:N, S:U) is consistent with a crash/DoS as the most reliable outcome. Memory corruption in a C library creates the theoretical potential for further exploitation (e.g., code execution), but this is not demonstrated by available data and must not be assumed. Note the necessary condition for an attacker: the malicious/MITM server must be the source of HTTP responses for the affected code path. Applications restricted to trusted servers or using incremental on_data_read are explicitly out of scope.

Impact Assessment

• CVSS v3.1: 5.9 (MEDIUM) — AV:N / AC:H / PR:N / UI:N / S:U / C:N / I:N / A:H.
• Confidentiality (C:N): No confidentiality impact per the vector.
• Integrity (I:N): No integrity impact per the vector.
• Availability (A:H): High availability impact — the primary realized impact is denial of service via unexpected application termination, with possible memory corruption.
• Attack Complexity (AC:H): Successful exploitation depends on the crafted response reaching the under-allocation condition.

Business impact is concentrated in availability and stability of systems that use the PJLIB-UTIL HTTP client in whole-body mode. Affected products include VoIP/UC clients, embedded communications appliances, SIP endpoints, and any application that embeds PJSIP and performs HTTP requests to non-trusted origins. Because PJSIP is embedded, the upstream attribution "Teluu / PJSIP" may not reflect the shipping vendor; asset owners should map PJSIP usage across their estate. The blast radius is constrained by two factors stated in the description: the vulnerable code path (full-body buffering without on_data_read) and the exposure to untrusted/MITM servers. MITM position (e.g., on a hostile or compromised network path) is a realistic delivery channel for the crafted response. EPSS is low (0.00303, 22.8th percentile), and there is no CISA KEV listing, no public PoC, and no Nuclei template — indicating no observed, active mass exploitation at time of writing.

Detection Guidance

Detection is challenging because the vulnerability is exploited by a malicious or MITM HTTP server, not by a request the victim sends with an unusual signature. Defensive monitoring should therefore focus on (a) HTTP responses to PJSIP-based clients with anomalous Content-Length behavior, (b) process crashes of PJSIP-embedding binaries, and (c) network flow anomalies on relevant ports. The rules below are pragmatic templates, not signatures for a documented exploit.

Sigma Rule

title: Potential PJSIP PJLIB-UTIL HTTP Client Heap Overflow Exploitation (CVE-2026-57164)
id: 8f2c1a7e-5b3d-4c9a-9e21-7a6c0d9b2f14
status: experimental
description: Detects process crashes of PJSIP-embedding binaries consistent with a crafted HTTP response triggering a heap buffer overflow in PJLIB-UTIL http_client.c
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-57164
author: valtersit.com
date: 2026/02/10
logsource:
  category: process_termination
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/pjsua'
      - '/pjsua-x86_64'
      - '/pjsua-arm'
  selection_fault:
    ExitCode: 11
  condition: selection_process and selection_fault
fields:
  - Image
  - CommandLine
  - ExitCode
falsepositives:
  - Legitimate crash of PJSIP binaries for unrelated reasons
level: medium
tags:
  - attack.t1190
  - cve.2026-57164

YARA Rule

rule CVE_2026_57164_PJSIP_http_client_heap_overflow
{
    meta:
        description = "Identifies PJSIP builds potentially affected by the PJLIB-UTIL HTTP client heap buffer overflow (CVE-2026-57164)"
        author = "valtersit.com"
        date = "2026-02-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-57164"
        cve = "CVE-2026-57164"

    strings:
        $src1 = "http_client.c" ascii wide
        $lib1 = "PJLIB-UTIL" ascii wide nocase
        $lib2 = "PJSIP" ascii wide
        $lib3 = "libpjlib-util" ascii wide
        $sym1 = "on_data_read" ascii
        $sym2 = "Content-Length" ascii nocase

    condition:
        (uint16(0) == 0x5a4d or uint32(0) == 0x464c457f or uint32(0) == 0xcafebabe) and
        (2 of ($src1, $lib1, $lib2, $lib3)) and
        any of ($sym1, $sym2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-57164 PJSIP HTTP client suspicious Content-Length in server response"; flow:from_server,established; http.response_header; content:"Content-Length|3a|"; pcre:"/Content-Length\x3a\s*\d+/i"; threshold:type both, track by_src, count 1, seconds 60; metadata:cve CVE-2026-57164; classtype:attempted-dos; sid:2026571640; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ process where process.name in ("pjsua", "pjsua-x86_64", "pjsua-arm") ]
  [ process where event.action == "terminated" and
      process.name in ("pjsua", "pjsua-x86_64", "pjsua-arm") and
      (process.exit_code == 11 or process.exit_code == 139) ]

Splunk SPL Query

index=endpoint OR index=network
| eval cve="CVE-2026-57164"
| where (match(lower(process_name), "pjsua|pjlib|pjsip") AND (exit_code="11" OR exit_code="139"))
        OR (match(lower(http_header), "content-length") AND match(lower(http_header), "pjsip"))
| stats count min(_time) as first_seen max(_time) as last_seen values(process_name) as processes values(dest) as destinations by host, cve
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="pjsip,cve-2026-57164,">
  <rule id="2026571" level="8">
    <decoded_as>json</decoded_as>
    <field name="program">pjsua|pjsip|pjlib-util</field>
    <regex type="pcre2">(?i)(heap|buffer overflow|http_client|on_data_read|content-length)</regex>
    <description>CVE-2026-57164: Possible PJSIP PJLIB-UTIL HTTP client heap buffer overflow activity</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026572" level="10">
    <if_sid>2026571</if_sid>
    <regex type="pcre2">(?i)(segfault|signal 11|abort|SIGSEGV|SIGABRT)</regex>
    <description>CVE-2026-57164: PJSIP-embedding process crashed following suspicious HTTP response handling</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY (2 independent sources — NVD and OSV — confirm the fix).

1. Immediate mitigations

   • Restrict affected applications from making HTTP requests to untrusted, configurable, or third-party servers where possible; the description states applications that "only connect to trusted servers are not affected."
   • Where feasible, prefer response consumption via the incremental on_data_read callback path instead of whole-body buffering; the description states applications consuming responses incrementally are not affected.
   • Enforce TLS with certificate verification for outbound HTTP from PJSIP-based components to reduce MITM delivery of crafted responses.
   • Segment/limit egress from embedded and VoIP devices so a hostile server cannot easily be reached or injected.

2. Patch / upgrade steps

   • Apply PJSIP commit 8d5956a (the vendor is Teluu; the fix touching http_client.c).
   • Because no fixed release version is published in the provided data and OSV shows the package mapping as unfixed, coordinate with your upstream product vendor (the shipper of the embedded PJSIP) to confirm they have incorporated commit 8d5956a, and track their advisory for a shipped version.
   • Rebuild any statically linked components that bundle the PJSIP/PJLIB-UTIL HTTP client.

3. Long-term hardening

   • Maintain an SBOM to identify all products embedding PJSIP (attribution to "Teluu/PJSIP" may not match the shipping vendor).
   • Add regression testing around HTTP response parsing and buffer sizing in code paths that fully buffer responses.
   • Monitor the PJSIP project for the release containing commit 8d5956a and subscribe to NVD/OSV updates (currently EPSS 0.00303; no KEV, no public PoC).

References

• NVD — CVE-2026-57164: https://nvd.nist.gov/vuln/detail/CVE-2026-57164
• OSV (PJSIP / unfixed package mapping): https://osv.dev/vulnerability/CVE-2026-57164
• PJSIP project repository / commit 8d5956a (vendor fix): https://github.com/pjsip/pjproject
• PJSIP project homepage (Teluu): https://www.pjsip.org/
• CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html

Threat actor campaigns / exploit-in-the-wild: None recorded. CISA KEV: NO. Public PoC: None. Nuclei template: NO. Exploit code: None. EPSS 0.00303 (22.8th percentile).