{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pjsip--2.14.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*","cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2024-51493"},{"cvss":4.8,"id":"CVE-2024-51494"},{"cvss":4.8,"id":"CVE-2024-51495"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PJSIP (\u003c 2.14.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PJSIP"],"content_html":"\u003cp\u003ePJSIP, a widely used open-source multimedia communication library, is vulnerable to multiple security flaws including heap buffer overflows and integer overflows (CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495). These vulnerabilities stem from improper processing of incoming SIP messages. An unauthenticated remote attacker can exploit these flaws by sending specially crafted SIP packets to an application utilizing the affected PJSIP versions. Successful exploitation may result in unauthorized data manipulation, information disclosure, or a denial-of-service (DoS) state, where the affected service crashes or becomes unresponsive. Versions prior to 2.14.1 are confirmed to be vulnerable. Defenders should prioritize updating instances of PJSIP to version 2.14.1 or later to mitigate these risks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities allows an unauthenticated remote attacker to disrupt communication services via a denial-of-service, or potentially gain control over the affected application through memory corruption. PJSIP is integrated into numerous VoIP, unified communications, and softphone products, making this impact widespread across organizations relying on real-time communication infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all instances of PJSIP by upgrading to version 2.14.1 or later to address CVE-2024-51493, CVE-2024-51494, and CVE-2024-51495.\u003c/li\u003e\n\u003cli\u003eAudit network logs for anomalous SIP traffic or malformed packets directed toward VoIP infrastructure and softphone services.\u003c/li\u003e\n\u003cli\u003eReview vendor-specific advisories for any proprietary products that bundle PJSIP, as they may require product-specific patches beyond the library update.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T16:23:03Z","date_published":"2026-10-15T16:23:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pjsip-vulnerabilities/","summary":"PJSIP contains multiple vulnerabilities, including heap buffer and integer overflows in SIP message processing, which can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition or potentially execute arbitrary code.","title":"Multiple Vulnerabilities in PJSIP","url":"https://feed.craftedsignal.io/briefs/2026-10-pjsip-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - PJSIP (\u003c 2.14.1)","version":"https://jsonfeed.org/version/1.1"}