CVE-2023-27585 – A buffer overflow vulnerability in PJSIP's DNS ... (How to Fix)

📋 TL;DR

A buffer overflow vulnerability in PJSIP's DNS resolver allows attackers to execute arbitrary code or cause denial of service by sending specially crafted DNS responses. This affects applications using PJSIP versions 2.13 and earlier with DNS resolution enabled. Users who disable DNS resolution or use external resolvers are not affected.

💻 Affected Systems

Products:

PJSIP (pjproject)
Any application using PJSIP library

Versions: 2.13 and earlier

Operating Systems: All platforms running PJSIP

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using PJSIP's built-in DNS resolver. Applications using external DNS resolution are not vulnerable.

📦 What is this software?

Pjsip by Teluu

View all CVEs affecting Pjsip →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.

🟠

Likely Case

Denial of service causing application crashes and service disruption.

🟢

If Mitigated

No impact if DNS resolution is disabled or external resolvers are used.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending malicious DNS responses to the vulnerable resolver. Similar to CVE-2022-24793 but in different parsing function.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Master branch commit d1c5e4d and later

Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4

Restart Required: Yes

Instructions:

1. Update to latest PJSIP version from master branch
2. Apply commit d1c5e4da5bae7f220bc30719888bb389c905c0c5
3. Recompile and reinstall the library
4. Restart all applications using PJSIP

🔧 Temporary Workarounds

Disable DNS Resolution

all

Configure PJSIP to not use its built-in DNS resolver

Set nameserver_count = 0 in PJSIP configuration

Use External DNS Resolver

all

Configure application to use system DNS or external resolver instead of PJSIP's resolver

🧯 If You Can't Patch

Implement network segmentation to isolate PJSIP applications from untrusted DNS servers
Deploy DNS filtering/proxy to sanitize DNS responses before they reach PJSIP

🔍 How to Verify

Check if Vulnerable:

Check PJSIP version and verify if DNS resolution is enabled in configuration

Check Version:

pkg-config --modversion pjproject or check library headers

Verify Fix Applied:

Verify commit d1c5e4d is included in your build and test DNS functionality

📡 Detection & Monitoring

Log Indicators:

Application crashes with segmentation faults
DNS resolution failures
Memory corruption errors

Network Indicators:

Unusual DNS response patterns to PJSIP applications
Large DNS responses to PJSIP resolver

SIEM Query:

source="application.log" AND ("segmentation fault" OR "buffer overflow") AND process="pjsip"

📊 Metadata

CVE ID: CVE-2023-27585

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-120

Published: March 14, 2023

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-27585, you might also want to check these: