PJSIP

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. PJSIP qualifies at Tier 2 through its OSS-Fuzz integration, where a complicated, high-impact improvement tops out at $5,000 against a $100 floor, and memory-safety hardening can carry a 2× or 3× multiplier. Note that PJSIP's dual licence lets Teluu carry your contributed patch into its proprietary edition. Patches must be one to twelve months old at submission, are capped at three per person per month, and sanctions and territory exclusions apply. CVE history 4 Last 12 months 32 Lifetime Memory safety 55 % Parsing/validation 30 % Denial of service 10 % Code execution 4 % Latest advisories Loading the feed Overview PJSIP is the most widely embedded open-source SIP and media stack in existence. It is the default SIP channel driver in Asterisk as chan_pjsip , which puts it inside a very large fraction of the world's open-source PBXes and telephony appliances including FreePBX, and it is also the SIP stack in a long list of softphones, SIP hardware and mobile VoIP SDKs. SIP endpoints are internet-facing by design and parse attacker-controlled text before any authentication happens, and the appliance population is notoriously slow to patch. A parser bug here is a pre-auth remote bug against telephony infrastructure, and 85% of PJSIP's CVE history is memory safety and parsing. Teluu runs no bounty, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Reports go to [email protected] , a dedicated project security address, and cover PJSIP's own code across the whole stack. The bundled third-party codecs belong to their own projects pjsip , the SIP stack in full: the message parser in pjsip/src/pjsip/sip_parser.c , covering header, URI and multipart-body parsing, plus the dialog, transaction and session layers built on it pjmedia in full, covering SDP parsing and negotiation, RTP and RTCP packet handling, the SRTP glue and the media session state machine pjnath , the STUN, TURN and ICE implementation, which occupies coturn's problem space from the client side The transport layer in pjsip/src/pjsip/sip_transport_* , including UDP, TCP and TLS framing, and the DNS SRV resolver that decides which peer the stack talks to Media codec wrappers and the pjmedia file readers for WAV and AVI, which parse container data on behalf of the application pjlib and pjlib-util , the base utility layer that everything above it uses for buffers, strings and encoding Out of scope One-line patches for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules say will not generally be rewarded Bugs in the bundled third-party codecs Opus, Speex and libsrtp rather than in PJSIP's glue around them; each has its own OSS-Fuzz entry and its own Tier 2 line Asterisk-specific bugs, which belong to Sangoma's Asterisk project even though Asterisk embeds PJSIP as chan_pjsip Patches the Teluu maintainers decline, because the money attaches to a patch that is merged and stays merged rather than to one that is proposed Patches outside the one-to-twelve-month age window, and submissions beyond the cap of three per person per month Most-valued findings Pre-authentication memory corruption in sip_parser.c reachable from a single crafted SIP message, which is the defining bug shape for this project, the highest-value surface here, and a hit on an internet-facing PBX before any credential is checked SDP parsing flaws reachable during call setup, since an endpoint will parse an offer from a caller it has not yet authenticated Anything reachable through Asterisk's chan_pjsip on a default FreePBX-style deployment, because that is where PJSIP's real installed base lives and where the patch lag is longest Memory safety in the transport layer or the DNS SRV resolver, where a hostile peer or a poisoned DNS response drives the parse rather than an attacker who already has a call RTP, RTCP or SRTP handling bugs triggered by a remote media stream, which reach an endpoint that has already accepted the session and is no longer suspicious of it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the SIP message or SDP body that triggers it; if it cannot be reproduced it is not eligible Test against an endpoint you operate: SIP infrastructure carries live calls, and probing someone else's PBX is not research Bugs in bundled third-party codecs (Opus, Speex, libsrtp) belong to those projects, each of which has its own OSS-Fuzz entry and its own Tier 2 line; PJSIP's glue around them is what is covered here Asterisk-specific bugs belong to Asterisk and Sangoma, even though Asterisk embeds PJSIP as its default SIP channel driver PJSIP is dual-licensed under GPL-2.0-or-later and a proprietary licence Teluu sells, which means a patch you contribute can be relicensed into Teluu's commercial edition, so decide whether you are comfortable with that before you write one If you also want the Google patch money, land the fix upstream and keep it merged without reverts for one month; on that pathway PJSIP is Tier 2 via OSS-Fuzz, patches must be one to twelve months old, submissions are capped at three per person per month, and Google cannot pay anyone on a sanctions list or located in Russia or Belarus Disclosure Coordinated with Teluu through [email protected] , a dedicated project security address that is also the OSS-Fuzz primary contact, and the project maintains a public advisory history. Patch Rewards adds no confidentiality or embargo term, so timing is Teluu's call. Hold the detail well past the release, because the fix has to reach Asterisk, then FreePBX, then a very long tail of appliances and handsets that update slowly or not at all. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability