CVE-2026-57164

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>pjsip</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PJSIP is a free and open source multimedia communication library
	written in C. Prior to commit 8d5956a, a heap buffer overflow exists
	in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP
	response body. This affects applications that use the PJLIB-UTIL HTTP
	client to receive a whole response body at once (a completion callback
	with no incremental on_data_read callback). When growing the response
	buffer, an incorrect size calculation based on the server-supplied
	Content-Length can leave the buffer too small, causing response data
	to be written past the end of the allocation. A malicious or
	man-in-the-middle HTTP server can trigger this with a crafted
	response; impact may range from unexpected application termination to
	memory corruption. Applications that consume the response
	incrementally (via on_data_read), or that only connect to trusted
	servers, are not affected. This issue has been patched via commit
	8d5956a.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-57164</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-57164</url>
    </references>
    <dates>
      <discovery>2026-09-04</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>