CVE-2021-37706

CRITICAL

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the ...

Affects 4 products across 4 vendors.

CVSS 3.19.8
EPSS4.9%
Percentile92th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-191: CWE-191
◆ AI Analysis — automated analysis, not human-reviewed

CVE-2021-37706 affects PJSIP versions where an integer underflow can occur due to improper header length checking in STUN messages with ERROR-CODE attributes, potentially leading to memory corruption or denial of service.

BSID: BS-2021-GLOBAL-304554-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-37706?
CVE-2021-37706 affects PJSIP versions where an integer underflow can occur due to improper header length checking in STUN messages with ERROR-CODE attributes, potentially leading to memory corruption or denial of service.
What is the CVSS score for CVE-2021-37706?
CVE-2021-37706 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 4.9%.
Is CVE-2021-37706 actively exploited?
No confirmed active exploitation of CVE-2021-37706 as of 2026-09-25.
How do I remediate CVE-2021-37706?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-37706?
CVE-2021-37706 affects Asterisk Certified Asterisk; Debian Debian Linux; Sangoma Asterisk; Teluu Pjsip.
Vulnerability Details
CVE IDCVE-2021-37706
BSIDBS-2021-GLOBAL-304554-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2021-12-22
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-191
SourceNVD
Official Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a malicious STUN message containing an ERROR-CODE attribute with a specific length to trigger an integer underflow in the PJSIP library, which could result in memory corruption or a denial of service condition.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Asterisk Certified Asterisk 16.8.0 < 16.8.0
Debian Debian Linux 9.0 10.0
Sangoma Asterisk ≥ 16.0.0, < 16.24.1 ≥ 18.0.0, < 18.10.1 ≥ 19.0.0, < 19.2.1
Teluu Pjsip ≤ 2.11.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1758 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash21541092fb0ab3ff1833bf9050c8ebcad9a971520cc409696c456991a8b80304b7c518aef04bfe79568b00d6432e6c9405a565011929ee26775783baa3d32553
Related CVEs affecting Asterisk
CVE-2007-2488 10.0 The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not prop... CVE-2022-23608 9.8 PJSIP is a free and open source multimedia communication library written in C... CVE-2008-1390 9.3 The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 a... CVE-2007-3762 9.3 Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asteris... CVE-2022-21723 9.1 PJSIP is a free and open source multimedia communication library written in C...
View all Asterisk CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →