CVE-2021-32686

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
pjsippjproject< 2.11.1

References

Timeline

Published
Jul 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-326877.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited CVE-2021-326888.8Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication CVE-2021-326896.5Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse aCVE-2021-326908.6Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exCVE-2021-326919.8Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations CVE-2021-326929.6Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands onCVE-2021-326938.8Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authenCVE-2021-326945.5Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possibCVE-2021-326953.3Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gottenCVE-2021-326965.3The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnCVE-2021-326975.3neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be CVE-2021-326984.9eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of
CVE-2021-32686: Medium severity, CVSS 5.9 | Vulnix