ALPINE-CVE-2026-32945
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-32945
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-32945.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-32945
- Upstream
- Published
- 2026-03-20T04:16:49.927Z
- Modified
- 2026-06-15T18:18:11.078722512Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsuaconfig.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver (e.g., getaddrinfo()) by not configuring a nameserver, or those using an external resolver via pjsipresolversetextresolver(). This issue is fixed in version 2.17. For users unable to upgrade, a workaround is to disable DNS resolution in the PJSIP config (by setting nameservercount to zero) or to use an external resolver implementation instead.
- References