CVE-2026-42225

GnuTLS backend silently skips certificate chain verification when verify_peer is false

Published May 7, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.

Analysis

Technical impact

This vulnerability allows PJSIP to accept TLS connections presenting invalid or untrusted certificates even when the application explicitly enables certificate verification. The GnuTLS backend silently skips certificate chain validation, enabling an attacker to pose as a legitimate server or client and intercept or modify media streams. The weakness is catalogued as CWE‑295 (Improper Certificate Validation).

Affected Systems

The problem affects the PJSIP multimedia communication library (pjproject) on builds that use GnuTLS as the TLS backend. Versions prior to 2.17 are vulnerable; the patch was incorporated in release 2.17 and later.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity with serious implications for confidentiality and integrity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an adversary establishing a TLS session to a PJSIP endpoint with a forged certificate; because verification is bypassed, the connection is accepted and an attacker can intercept or alter the protected media stream, demonstrating a remote exploit that requires no additional privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pjsip

pjproject

affected

Version	Status	Constraints
`< 2.17`	affected	—

Configuration 1 [-]

cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Pjsip

Pjproject

Version	Status	Scheme	Platform
`[0,2.17)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to PJSIP 2.17 or later where certificate verification is properly enforced.
If upgrading cannot be applied immediately, disable or remove TLS-based transport to eliminate the risk of accepting untrusted connections.
As a temporary measure, add application‑level checks after the TLS handshake to reject any certificates that are not explicitly trusted, such as verifying the certificate fingerprint against a whitelist.

Generated by OpenCVE AI on May 7, 2026 at 20:20 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4631-1	asterisk security update

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.161% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920
https://github.com/pjsip/pjproject/releases/tag/2.17
https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx

History

May 12, 2026 4:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Teluu Teluu pjsip
CPEs		cpe:2.3:a:teluu:pjsip::::::::
Vendors & Products		Teluu Teluu pjsip
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

May 8, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 7, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pjsip Pjsip pjproject
Vendors & Products		Pjsip Pjsip pjproject

May 7, 2026 7:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.
Title		GnuTLS backend silently skips certificate chain verification when verify_peer is false
Weaknesses		CWE-295
References		https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920 https://github.com/pjsip/pjproject/releases/tag/2.17 https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}`