CVE-2026-57164

PJSIP's PJLIB-UTIL HTTP client (http_client.c) contains a heap buffer overflow (CWE-122) that occurs when the library buffers an entire HTTP response body at once. When an application uses the completion-callback mode (with no incremental on_data_read callback), the code sizes the response buffer from the server-supplied Content-Length header and can allocate too little, so a crafted response causes data to be written past the end of the heap allocation. A malicious or man-in-the-middle HTTP server can exploit this to terminate the application or corrupt memory; the CVSS v4.0 vector rates integrity and availability impact as high with no confidentiality impact. Only applications built on pjproject that use the PJLIB-UTIL HTTP client to read whole responses from untrusted servers are affected; incremental readers and deployments limited to trusted servers are not. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS currently estimates about a 0.3% probability of exploitation within 30 days.

What to do: If your application uses the PJLIB-UTIL HTTP client in whole-response (completion-callback) mode, rebuild against pjproject that includes commit 8d5956a or apply that commit. As interim mitigation, restrict the HTTP client to trusted HTTPS servers or switch response consumption to the incremental on_data_read callback. Audit your integration to confirm which read mode you use before deciding whether to patch urgently.