Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

PJSIP bug bounty programs

pjsip.org Updated

PJSIP runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program PJSIP runs.

  • PJSIP

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 5 excluded.

  • https://www.pjsip.org

    Web

  • Media codec wrappers and the pjmedia file readers for WAV and AVI, which parse container data on behalf of the application

    Products and areas

  • pjlib and pjlib-util, the base utility layer that everything above it uses for buffers, strings and encoding

    Products and areas

  • pjmedia in full, covering SDP parsing and negotiation, RTP and RTCP packet handling, the SRTP glue and the media session state machine

    Products and areas

  • pjnath, the STUN, TURN and ICE implementation, which occupies coturn's problem space from the client side

    Products and areas

  • pjsip, the SIP stack in full: the message parser in pjsip/src/pjsip/sip_parser.c, covering header, URI and multipart-body parsing, plus the dialog, transaction and session layers built on it

    Products and areas

  • Reports go to [email protected], a dedicated project security address, and cover PJSIP's own code across the whole stack. The bundled third-party codecs belong to their own projects

    Products and areas

  • The transport layer in pjsip/src/pjsip/sip_transport_*, including UDP, TCP and TLS framing, and the DNS SRV resolver that decides which peer the stack talks to

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Asterisk-specific bugs, which belong to Sangoma's Asterisk project even though Asterisk embeds PJSIP as chan_pjsip

  • Bugs in the bundled third-party codecs Opus, Speex and libsrtp rather than in PJSIP's glue around them; each has its own OSS-Fuzz entry and its own Tier 2 line

  • One-line patches for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules say will not generally be rewarded

  • Patches outside the one-to-twelve-month age window, and submissions beyond the cap of three per person per month

  • Patches the Teluu maintainers decline, because the money attaches to a patch that is merged and stays merged rather than to one that is proposed

Recent changes

Reward and scope changes across every PJSIP program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in PJSIP products, from the NVD.

Search NVD
  • CVE-2026-40892 High

    PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (1

  • CVE-2026-40614 High

    PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers (dec_frame[].buf) were allocated based on a PCM-derived formula: (sample_rate/1000) * 60 * channel_cnt * 2. At 8 kHz mono this yields only 960 b

  • CVE-2026-33069 Medium

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This allows 1-2 bytes of adjacent heap memory to be read. All applications that process incoming SIP mess

  • CVE-2026-32942 High

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17.

  • CVE-2026-32945 High

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability in the DNS parser's name length handler. Thisimpacts applications using PJSIP's built-in DNS resolver, such as those configured with pjsua_config.nameserver or UaConfig.nameserver in PJSUA/PJSUA2. It does not affect users who rely on the OS resolver

  • CVE-2026-29068 High

    PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack buffer overflow vulnerability when pjmedia-codec parses an RTP payload contain more frames than the caller-provided frames can hold. This issue has been patched in version 2.17.

  • CVE-2026-28799 High

    PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with Expires=0). This issue has been patched in version 2.17.

  • CVE-2026-26967 High

    PJSIP is a free and open source multimedia communication library written in C. In versions 2.16 and below, there is a critical Heap-based Buffer Overflow vulnerability in PJSIP's H.264 unpacketizer. The bug occurs when processing malformed SRTP packets, where the unpacketizer reads a 2-byte NAL unit size field without validating that both bytes are within the payload buffer bounds. The vulnerabili

About this page

This page gathers every public program listed under pjsip.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.