In 2.17 and earlier of the PJSIP library, the OpenSSL and GnuTLS backends copy DNS SubjectAltName values using string functions that truncate at an embedded NUL byte; a certificate that contains the target hostname prefix followed by an embedded NUL and a malicious suffix can therefore be accepted as a match for the prefix hostname when TLS server identity checking is enabled, allowing an attacker who can supply such a certificate to impersonate the intended server, intercept the SIP session, and steal REGISTER credentials without requiring code execution on the server.

The vulnerability affects the PJSIP multimedia communication library (pjproject) in versions 2.17 and earlier when using the OpenSSL or GnuTLS backends; the mbedTLS backend is not affected and the flaw is located in pjlib/src/pj/ssl_sock_ossl.c and pjlib/src/pj/ssl_sock_gtls.c.

The CVSS score of 7.4 indicates high severity; EPSS is not available and the issue is not listed in the CISA KEV catalog. An attacker must control the network path to perform a man-in-the-middle attack and obtain a trusted certificate that includes a forged SubjectAltName; with those conditions met, the flaw can be exploited by supplying the custom certificate, enabling impersonation of the SIP server and capture of authentication credentials. The absence of a public patch increases the risk for all deployments using the affected backends until a fix is released.