# CVE-2026-42225: PJSIP improper certificate validation in GnuTLS backend

Source: https://junglewise.ai/threats/cve-2026-42225-pjsip-improper-certificate-validation-in-gnutls-backend  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42225 · Severity: medium · CVSS 5.9 · Published 2026-05-07

PJSIP is an open-source library used for multimedia communications like voice and video calls. A security flaw in its GnuTLS integration allows the software to accept invalid or untrusted security certificates even when verification is turned on. This could allow an attacker to intercept private communications or bypass security checks that require valid client identification.

Technologies: [Teluu Pjsip](https://junglewise.ai/threats/technologies/pjsip). Vendors: [Teluu](https://junglewise.ai/threats/vendors/teluu).

## Quick answers

**Is CVE-2026-42225 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42225 being exploited in the wild.

**How severe is CVE-2026-42225?** Medium severity, with a CVSS score of 5.9, published 7 May 2026.

**Which products and versions are affected?** Teluu Pjsip < 2.17.

**Is there a fix for CVE-2026-42225?** A patch was published on 2026-04-22: Version 2.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42225 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42225?** Check whether you run Teluu Pjsip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the PJSIP GnuTLS backend (pjlib/src/pj/ssl_sock_gtls.c) where certificate chain verification is silently skipped if the internal 'verify_peer' flag is false. In the SIP TLS transport (sip_transport_tls), the library is designed to set 'verify_peer' to false and handle certificate policy enforcement at a higher layer. However, because the GnuTLS backend failed to populate the 'verify_status' flags when 'verify_peer' was false, the upper layers received no error information and incorrectly accepted invalid, expired, or self-signed certificates. This enables Man-in-the-Middle (MitM) attacks on outbound SIPS connections and bypasses mutual-TLS (mTLS) requirements in server mode. The issue is fixed in version 2.17 by ensuring certificate status flags are always mapped regardless of the 'verify_peer' setting.

## Affected products

- Teluu PJSIP < 2.17

## Timeline

- 2026-04-21: advisory: Vendor advisory GHSA-x2fv-6j6c-pxmx published
- 2026-04-22: patched: Version 2.17 released
- 2026-05-07: disclosed: CVE-2026-42225 published

## References

- [https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920](https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920)
- [https://github.com/pjsip/pjproject/releases/tag/2.17](https://github.com/pjsip/pjproject/releases/tag/2.17)
- [https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx](https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx)

## Related threats

- [PJSIP stack buffer overflow in telnet CLI](https://junglewise.ai/threats/cve-2026-57166-pjsip-stack-buffer-overflow-in-telnet-cli)
- [PJSIP stack buffer overflow in telnet CLI history redraw](https://junglewise.ai/threats/cve-2026-57165-pjsip-stack-buffer-overflow-in-telnet-cli-history-redraw)
- [PJSIP heap buffer overflow in HTTP client](https://junglewise.ai/threats/cve-2026-57164-pjsip-heap-buffer-overflow-in-http-client)
- [PJSIP stack buffer overflow in GnuTLS TLS backend](https://junglewise.ai/threats/cve-2026-57163-pjsip-stack-buffer-overflow-in-gnutls-tls-backend)
- [PJSIP stack buffer overflow in SRTP/SDES SDP processing](https://junglewise.ai/threats/cve-2026-57162-pjsip-stack-buffer-overflow-in-srtp-sdes-sdp-processing)