# CVE-2026-84975: PJSIP TLS server identity verification bypass via embedded NUL in certificate SubjectAltName

Source: https://junglewise.ai/threats/cve-2026-84975-pjsip-is-a-free-and-open-source-multimedia-communication-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84975 · Severity: high · CVSS 7.4 · Published 2026-09-18

PJSIP is a multimedia communication library that provides VoIP/SIP calling capabilities for applications. When server verification is enabled, the library fails to properly validate TLS certificates containing DNS names with embedded NUL bytes, allowing an attacker with a trusted certificate to impersonate the legitimate server and intercept SIP sessions, including stealing login credentials. An attacker would need network access to intercept connections and a certificate issued by a trusted certificate authority.

Technologies: [PJSIP](https://junglewise.ai/threats/technologies/pjsip-pjsip). Vendors: [PJSIP](https://junglewise.ai/threats/vendors/pjsip).

## Quick answers

**Is CVE-2026-84975 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84975 being exploited in the wild.

**How severe is CVE-2026-84975?** High severity, with a CVSS score of 7.4, published 18 September 2026.

**Which products and versions are affected?** PJSIP 2.17 and earlier.

**Is there a fix for CVE-2026-84975?** A patch was published on 2026-07-17: Fixed on master in commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84975 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84975?** Check whether you run PJSIP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OpenSSL and GnuTLS backends in pjlib's SSL socket implementation copy DNS SubjectAltName certificate attributes using strlen()-based string functions, which truncate at the first NUL byte and discard the explicit length returned by the underlying crypto libraries. This allows a certificate with a SAN like "victim.example\0.attacker" to be accepted for "victim.example" during hostname verification. The mbedTLS backend is unaffected because it preserves explicit string length during the copy operation. An attacker with a certificate from a trusted issuer who can intercept the TLS connection gains the ability to complete SIP handshakes and receive REGISTER credentials.

## Affected products

- PJSIP PJSIP 2.17 and earlier

## Timeline

- 2026-07-17: disclosed
- 2026-07-17: patched: Fixed on master in commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd
- 2026-09-18: advisory

## References

- [https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd](https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd)
- [https://github.com/pjsip/pjproject/security/advisories/GHSA-382p-87mh-r3q8](https://github.com/pjsip/pjproject/security/advisories/GHSA-382p-87mh-r3q8)

## Related threats

- [PJSIP heap buffer overflow in AVI parser](https://junglewise.ai/threats/cve-2026-77396-pjsip-is-a-free-and-open-source-multimedia-communication-library)
- [PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer…](https://junglewise.ai/threats/cve-2026-40892-pjsip-is-a-free-and-open-source-multimedia-communication-library)
- [PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer…](https://junglewise.ai/threats/cve-2026-40614-pjsip-is-a-free-and-open-source-multimedia-communication-library)