PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 8.1, indicating it can be exploited remotely over the network but requires specific conditions to be met without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 4 products from teluu, from asterisk, from sangoma and 1 other, organizations running these solutions should prioritize assessment and patching.
Reported in 2022, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.
2022-02-22T20:15:07.693
2025-11-04T16:15:47.087
Modified
CVSSv3.1: 8.1 (HIGH)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | teluu | pjsip | ≤ 2.11.1 | Yes |
| Application | asterisk | certified_asterisk | < 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | asterisk | certified_asterisk | 16.8.0 | Yes |
| Application | sangoma | asterisk | < 16.24.1 | Yes |
| Application | sangoma | asterisk | < 18.10.1 | Yes |
| Application | sangoma | asterisk | < 19.2.1 | Yes |
| Operating System | debian | debian_linux | 9.0 | Yes |
| Operating System | debian | debian_linux | 10.0 | Yes |
SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For teluu's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.