Homepage

Race Condition The advisory has been revoked - it doesn't affect any version of package pjproject  (opens in a new tab)

Threat Intelligence

EPSS
2.07% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-PJPROJECT-1619158
  • published21 Mar 2026
  • disclosed23 Jul 2021
Report a new vulnerability Found a mistake?

Introduced: 23 Jul 2021

CVE-2021-32686  (opens in a new tab)
CWE-362  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pjproject package and not the pjproject package as distributed by Ubuntu.

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.