CVE-2022-23608
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and includ...
Affects 4 products across 4 vendors.
Software references memory after it has been freed, leading to corruption, crashes, or code execution.
CVE-2022-23608 affects PJSIP versions up to and including 2.11.1, where a hash key shared by multiple UAC dialogs can be prematurely freed, potentially leading to undefined behavior or memory corruption.
BSID: BS-2022-GLOBAL-070352-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2022-23608?
What is the CVSS score for CVE-2022-23608?
Is CVE-2022-23608 actively exploited?
How do I remediate CVE-2022-23608?
What systems are affected by CVE-2022-23608?
| CVE ID | CVE-2022-23608 |
|---|---|
| BSID | BS-2022-GLOBAL-070352-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2022-02-22 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
Source: NIST NVD / MITRE CVE Database
An attacker could exploit this vulnerability by initiating multiple dialogs in a dialog set or forking scenario, causing a hash key to be freed prematurely. This could lead to memory corruption, which might be leveraged to execute arbitrary code or cause a denial of service.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Asterisk | Certified Asterisk | 16.8.0 < 16.8.0 |
| Debian | Debian Linux | 9.0 10.0 |
| Sangoma | Asterisk | ≥ 16.0.0, < 16.24.1 ≥ 18.0.0, < 18.10.1 ≥ 19.0.0, < 19.2.1 |
| Teluu | Pjsip | ≤ 2.11.1 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 8d1096a0d65f947563a2ec02d976ff87ae5df317001d890d78472faeb46cab32ad259d045fb950c5c49a2abe02cdd90b6ebc6652d705ea25423e9b850d6010be |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →