Heap Buffer Overflow in PJLIB-UTIL HTTP Client by PJSIP

CVE-2026-57164

What is CVE-2026-57164?

A heap buffer overflow vulnerability exists in the PJLIB-UTIL HTTP client affecting applications that process HTTP responses in a specific manner. When attempting to grow the response buffer while relying on an incorrectly calculated size from the server's Content-Length, the buffer can become insufficiently sized. This flaw enables attackers to potentially exploit the affected applications by delivering crafted HTTP responses, which could lead to unexpected application termination or memory corruption. As a preventive measure, it's advised to apply the patch from commit 8d5956a and ensure that applications use incremental data consumption methods or connect only to trusted servers.

References