Vulnerability Description
PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Teluu | Pjsip | < 2.17 |
Related Weaknesses (CWE)
References
- https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e289Patch
- https://github.com/pjsip/pjproject/releases/tag/2.17ProductRelease Notes
- https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmxPatchVendor Advisory
FAQ
What is CVE-2026-42225?
CVE-2026-42225 is a vulnerability with a CVSS score of 5.9 (MEDIUM). PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or...
How severe is CVE-2026-42225?
CVE-2026-42225 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42225?
Check the references section above for vendor advisories and patch information. Affected products include: Teluu Pjsip.