← Vulnerability feed

Vulnerability record · CVE-2022-39269 · published 6 October 2022

CVE-2022-39269: Teluu pjsip cleartext transmission vulnerability

Teluu · Pjsip

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

9.1 CVSS 3.1 Critical EPSS 0.73% · top 47.4% CWE-319 · Cleartext transmission
9.1CVSS 3.1 base score
0.73%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc PatchThird Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
https://security.gentoo.org/glsa/202210-37 Third Party Advisory
https://www.debian.org/security/2023/dsa-5358
https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc PatchThird Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
https://security.gentoo.org/glsa/202210-37 Third Party Advisory
https://www.debian.org/security/2023/dsa-5358

Track CVE-2022-39269 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-38703Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is …EPSS 1.3%9.8CVE-2022-23537Teluu pjsip heap-based buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 1.1%9.8CVE-2022-31031Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 2.0%9.8CVE-2022-24754Teluu pjsip classic buffer overflow vulnerabilityPJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stac…EPSS 2.1%9.8CVE-2022-23608Teluu pjsip use after free vulnerabilityPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, S…EPSS 4.0%9.8CVE-2021-43300Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a buffer overflow since it is co…EPSS 2.4%9.8CVE-2021-43303Teluu pjsip classic buffer overflow vulnerabilityBuffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer overflow, since supplying an o…EPSS 2.4%9.8CVE-2021-43301Teluu pjsip stack-based buffer overflow vulnerabilityStack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a buffer overflow since it is …EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2022-39269), CISA KEV, FIRST EPSS (scores of 2026-10-06). This page is refreshed as NVD updates the record.