Quick answers
- Is CVE-2026-84975 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84975 being exploited in the wild.
- How severe is CVE-2026-84975?
- High severity, with a CVSS score of 7.4, published 18 September 2026.
- Which products and versions are affected?
- PJSIP 2.17 and earlier.
- Is there a fix for CVE-2026-84975?
- A patch was published on 2026-07-17: Fixed on master in commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84975 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-84975?
- Check whether you run PJSIP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The OpenSSL and GnuTLS backends in pjlib's SSL socket implementation copy DNS SubjectAltName certificate attributes using strlen()-based string functions, which truncate at the first NUL byte and discard the explicit length returned by the underlying crypto libraries. This allows a certificate with a SAN like "victim.example\0.attacker" to be accepted for "victim.example" during hostname verification. The mbedTLS backend is unaffected because it preserves explicit string length during the copy operation. An attacker with a certificate from a trusted issuer who can intercept the TLS connection gains the ability to complete SIP handshakes and receive REGISTER credentials.
Affected products
- PJSIP PJSIP 2.17 and earlier
Timeline
- 2026-07-17: disclosed
- 2026-07-17: patched: Fixed on master in commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd
- 2026-09-18: advisory