CVE-2026-57163

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>pjsip</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PJSIP is a free and open source multimedia communication library
	written in C. Prior to commit c4a151a, a stack buffer overflow exists
	in the GnuTLS TLS backend when parsing the Subject Alternative Name
	extension of a peer certificate (tls_cert_get_info() in
	ssl_sock_gtls.c). Only GnuTLS builds are affected (--with-gnutls);
	OpenSSL and Apple SecureTransport/Network.framework builds are not
	affected. While extracting certificate information after a TLS
	handshake, an incorrect buffer-size value can cause an oversized
	SubjectAltName entry to be written past the end of a fixed-size stack
	buffer. A network-positioned attacker presenting a crafted certificate
	— a malicious server to a connecting client, or a malicious client
	to a server that requests certificates — can trigger this during the
	TLS handshake, before any SIP-level authentication. Impact may range
	from unexpected application termination to control flow hijack/memory
	corruption. This issue has been patched via commit c4a151a.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-57163</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-57163</url>
    </references>
    <dates>
      <discovery>2026-09-04</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>