CVE-2022-39269

critical

Published 2022-10-06 · Modified 2026-05-06

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

9.1

Description

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

Predictions

Exploit likelihood

94%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact

Debian Fixed 3 releases

Version	Status	Fixed in
sid	Fixed	`1:20.3.0~dfsg+~cs6.13.40431413-1`
bullseye	Fixed	`1:16.28.0~dfsg-0+deb11u2`
bookworm	Fixed	`20230206.0~ds1-1`

Application impact

Vendor	Product	Versions	Fixed
teluu	pjsip	`{"startIncluding":"2.11","endExcluding":"2.13"}`	`2.13`

References

CWEs

CWE-319

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.