DNS Subject Alternative Name Vulnerability in PJSIP Communication Library

CVE-2026-84975

What is CVE-2026-84975?

The PJSIP communication library exhibits a vulnerability in its OpenSSL and GnuTLS backends, where certain DNS SubjectAltName values can be improperly handled due to the truncation of an embedded NUL byte. This security issue arises when server verification is enabled, allowing a specially crafted certificate with a DNS SubjectAltName that includes an attacker-controlled suffix to be accepted. Consequently, an attacker who has the capability to intercept the connection can impersonate the intended server, potentially leading to unauthorized access to sensitive credentials exchanged during the session. It is important to note that the mbedTLS backend does not share this vulnerability as it correctly preserves explicit string length.

References