Quick answers
- Is CVE-2026-42225 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42225 being exploited in the wild.
- How severe is CVE-2026-42225?
- Medium severity, with a CVSS score of 5.9, published 7 May 2026.
- Which products and versions are affected?
- Teluu Pjsip < 2.17.
- Is there a fix for CVE-2026-42225?
- A patch was published on 2026-04-22: Version 2.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42225 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-42225?
- Check whether you run Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the PJSIP GnuTLS backend (pjlib/src/pj/ssl_sock_gtls.c) where certificate chain verification is silently skipped if the internal 'verify_peer' flag is false. In the SIP TLS transport (sip_transport_tls), the library is designed to set 'verify_peer' to false and handle certificate policy enforcement at a higher layer. However, because the GnuTLS backend failed to populate the 'verify_status' flags when 'verify_peer' was false, the upper layers received no error information and incorrectly accepted invalid, expired, or self-signed certificates. This enables Man-in-the-Middle (MitM) attacks on outbound SIPS connections and bypasses mutual-TLS (mTLS) requirements in server mode. The issue is fixed in version 2.17 by ensuring certificate status flags are always mapped regardless of the 'verify_peer' setting.
Affected products
- Teluu PJSIP < 2.17
Timeline
- 2026-04-21: advisory: Vendor advisory GHSA-x2fv-6j6c-pxmx published
- 2026-04-22: patched: Version 2.17 released
- 2026-05-07: disclosed: CVE-2026-42225 published