Hi Jonas,

The following vulnerabilities were published for asterisk. They are
all in the PJSIP part and AFAIK not yet in a tagged PJSIP release. The
security-tracker contains references to the fixes, can you
double-check please?

CVE-2026-57159[0]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit 673b978, a remote out-of-bounds read
| and write can occur in the SDP negotiator when the remote payload-
| type map maintenance feature is enabled. assign_pt_and_update_map()
| in pjmedia/src/pjmedia/sdp_neg.c uses payload-type numbers taken
| from a remote SDP offer or answer to index fixed-size internal
| tables without sufficient bounds validation, so a crafted remote SDP
| can cause memory access outside those tables. The practical impact
| is memory corruption and denial of service; code execution is not
| demonstrated. This path is only reached when
| PJMEDIA_SDP_NEG_MAINTAIN_REMOTE_PT_MAP is enabled. The default is
| disabled, so default builds are not affected; the feature is an
| interoperability option that integrating products may enable. This
| issue has been patched via commit 673b978.


CVE-2026-57160[1]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit d6a0e7f, a buffer overflow can occur
| in pjsip_generic_array_hdr_print() in pjsip/src/pjsip/sip_msg.c, the
| function that serializes generic array headers (such as Allow,
| Require, Supported, and Unsupported). Under certain output-buffer
| boundary conditions the function can write one byte past the end of
| the buffer. This is reachable mainly in applications that parse and
| re-serialize incoming SIP requests — for example a proxy, SBC, or
| B2BUA — where a remote peer can influence the serialized message.
| The out-of-bounds write is a single fixed byte; code execution and
| information disclosure are not demonstrated, and in typical pool-
| based allocations the byte falls within allocation slack. This issue
| has been patched via commit d6a0e7f.


CVE-2026-57161[2]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit acc03b5, a stack buffer overflow
| exists in PJSUA when processing Service-Route headers in a
| registration response (update_service_route() in pjsua_acc.c). This
| affects applications that register using the PJSUA/PJSUA2 account
| API (the default registration path). The Service-Route URIs from a
| 2xx response to REGISTER are stored into a fixed-size array without
| bounding the number of headers; a registrar that returns an
| excessive number of Service-Route headers can write past the end of
| the array on the stack. The values written are internal pointers
| rather than arbitrary data, so the most likely impact is unexpected
| application termination (denial of service), though memory
| corruption cannot be excluded. The malicious response may come from
| a compromised or malicious registrar, or — over unprotected
| transports — a spoofed response. This issue has been patched via
| commit acc03b5.


CVE-2026-57162[3]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit a1b707c, a stack buffer overflow
| exists in the SRTP/SDES media transport when processing a=crypto
| attributes during SDP offer/answer (sdes_encode_sdp() in
| transport_srtp_sdes.c). This affects applications with SRTP enabled
| (use_srtp optional or mandatory, using SDES keying). During media
| negotiation, the crypto attributes from the remote SDP are collected
| into a fixed-size array without bounding their number; a remote peer
| that includes an excessive number of a=crypto attributes in a single
| media description can write past the end of that array on the stack.
| This is reachable from an incoming SIP INVITE during offer/answer,
| before application-level authentication. Impact may range from
| unexpected application termination to control flow hijack/memory
| corruption. Applications that do not enable SRTP are not affected.
| This issue has been patched via commit a1b707c.


CVE-2026-57163[4]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit c4a151a, a stack buffer overflow
| exists in the GnuTLS TLS backend when parsing the Subject
| Alternative Name extension of a peer certificate
| (tls_cert_get_info() in ssl_sock_gtls.c). Only GnuTLS builds are
| affected (--with-gnutls); OpenSSL and Apple
| SecureTransport/Network.framework builds are not affected. While
| extracting certificate information after a TLS handshake, an
| incorrect buffer-size value can cause an oversized SubjectAltName
| entry to be written past the end of a fixed-size stack buffer. A
| network-positioned attacker presenting a crafted certificate — a
| malicious server to a connecting client, or a malicious client to a
| server that requests certificates — can trigger this during the TLS
| handshake, before any SIP-level authentication. Impact may range
| from unexpected application termination to control flow
| hijack/memory corruption. This issue has been patched via commit
| c4a151a.


CVE-2026-57164[5]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit 8d5956a, a heap buffer overflow exists
| in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP
| response body. This affects applications that use the PJLIB-UTIL
| HTTP client to receive a whole response body at once (a completion
| callback with no incremental on_data_read callback). When growing
| the response buffer, an incorrect size calculation based on the
| server-supplied Content-Length can leave the buffer too small,
| causing response data to be written past the end of the allocation.
| A malicious or man-in-the-middle HTTP server can trigger this with a
| crafted response; impact may range from unexpected application
| termination to memory corruption. Applications that consume the
| response incrementally (via on_data_read), or that only connect to
| trusted servers, are not affected. This issue has been patched via
| commit 8d5956a.


CVE-2026-57165[6]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit 628b716, a stack buffer overflow
| exists in the PJLIB-UTIL telnet CLI front-end when redrawing the
| command line during history recall (handle_up_down() in
| cli_telnet.c). This affects only applications that enable the telnet
| CLI front-end (same gating as the related CLI issue). The line-
| redraw sequence for a recalled history entry can accumulate more
| data than a fixed-size stack buffer holds, which may lead to
| application termination. Exploitation requires access to the
| unauthenticated telnet CLI, which already permits arbitrary CLI
| commands, so the additional impact is limited. Applications that do
| not enable the telnet CLI front-end are not affected. This issue has
| been patched via commit 628b716.


CVE-2026-57166[7]:
| PJSIP is a free and open source multimedia communication library
| written in C. Prior to commit 4472a31, a stack buffer overflow
| exists in the PJLIB-UTIL telnet CLI front-end when rendering
| feedback for an entered command line. Several command-line handling
| paths write an attacker-influenced amount of data into fixed-size
| buffers without sufficient bounds checking, so a long command line
| can overflow them. This affects only applications that enable the
| telnet CLI front-end (e.g. pj_cli_telnet_create() / --cli-telnet-
| port). The telnet CLI is an interactive administration interface
| with no authentication, so any client able to reach it can already
| issue arbitrary CLI commands. A malformed or overly long command
| line can overflow a fixed-size stack buffer while rendering command-
| line feedback, which may lead to application termination. Because
| reaching this code already requires access to the unauthenticated
| CLI, the impact beyond that existing access is limited. Applications
| that do not enable the telnet CLI front-end are not affected. This
| issue has been patched via commit 4472a31.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57159
https://www.cve.org/CVERecord?id=CVE-2026-57159
[1] https://security-tracker.debian.org/tracker/CVE-2026-57160
https://www.cve.org/CVERecord?id=CVE-2026-57160
[2] https://security-tracker.debian.org/tracker/CVE-2026-57161
https://www.cve.org/CVERecord?id=CVE-2026-57161
[3] https://security-tracker.debian.org/tracker/CVE-2026-57162
https://www.cve.org/CVERecord?id=CVE-2026-57162
[4] https://security-tracker.debian.org/tracker/CVE-2026-57163
https://www.cve.org/CVERecord?id=CVE-2026-57163
[5] https://security-tracker.debian.org/tracker/CVE-2026-57164
https://www.cve.org/CVERecord?id=CVE-2026-57164
[6] https://security-tracker.debian.org/tracker/CVE-2026-57165
https://www.cve.org/CVERecord?id=CVE-2026-57165
[7] https://security-tracker.debian.org/tracker/CVE-2026-57166
https://www.cve.org/CVERecord?id=CVE-2026-57166

Regards,
Salvatore