{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apjsippjproject/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pjsip:pjproject:*:*:*:*:*:*:*:*","cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-32945"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pjproject (\u003c= 2.16)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Pjsip"],"content_html":"\u003cp\u003eCVE-2026-32945 is a heap-based out-of-bounds (OOB) read vulnerability affecting Pjsip (pjproject) versions 2.16 and earlier. The flaw resides in the DNS compression pointer parsing logic within \u003ccode\u003eget_name_len()\u003c/code\u003e and \u003ccode\u003eget_name()\u003c/code\u003e in \u003ccode\u003edns.c\u003c/code\u003e. An attacker can trigger a crash in any application utilizing this library (including Asterisk and FreeSWITCH) by responding to a DNS query with a crafted 20-byte packet where the compression pointer marker (0xC0) is the final byte, causing an out-of-bounds memory read.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a remote denial-of-service (DoS) condition, crashing the Pjsip-based application. No remote code execution has been documented, but public proof-of-concept code is available to trigger the crash.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all deployments utilizing the Pjsip library to version 2.17 or later immediately.\u003c/li\u003e\n\u003cli\u003ePatching requires an update to the core library; ensure applications linked against \u003ccode\u003elibpjproject\u003c/code\u003e are recompiled or updated with the fixed library version (commit 5311aee).\u003c/li\u003e\n\u003cli\u003eReview network configurations for VOIP infrastructure; ensure DNS resolution is restricted to trusted, internal, or hardened recursive resolvers to mitigate the risk of rogue DNS response delivery.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T04:55:53Z","date_published":"2026-11-01T04:55:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pjsip-dns-oob/","summary":"A heap-based out-of-bounds read vulnerability in the Pjsip DNS parser allows unauthenticated remote attackers to cause a denial-of-service via a crafted DNS response.","title":"Pjsip: Heap out-of-bounds read in DNS parser (CVE-2026-32945)","url":"https://feed.craftedsignal.io/briefs/2026-11-pjsip-dns-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pjsip:pjproject:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}