Executive brief
PJSIP is an open-source library used for multimedia communications like voice and video calls. A security flaw in its GnuTLS integration allows the software to accept invalid or untrusted security certificates even when verification is turned on. This could allow an attacker to intercept private communications or bypass security checks that require valid client identification.
Technical details
A vulnerability exists in the PJSIP GnuTLS backend (pjlib/src/pj/ssl_sock_gtls.c) where certificate chain verification is silently skipped if the internal 'verify_peer' flag is false. In the SIP TLS transport (sip_transport_tls), the library is designed to set 'verify_peer' to false and handle certificate policy enforcement at a higher layer. However, because the GnuTLS backend failed to populate the 'verify_status' flags when 'verify_peer' was false, the upper layers received no error information and incorrectly accepted invalid, expired, or self-signed certificates. This enables Man-in-the-Middle (MitM) attacks on outbound SIPS connections and bypasses mutual-TLS (mTLS) requirements in server mode. The issue is fixed in version 2.17 by ensuring certificate status flags are always mapped regardless of the 'verify_peer' setting.
Affected products
- Teluu PJSIP < 2.17
Timeline
- 2026-04-21: advisory: Vendor advisory GHSA-x2fv-6j6c-pxmx published
- 2026-04-22: patched: Version 2.17 released
- 2026-05-07: disclosed: CVE-2026-42225 published