Vulnerability · Published May 7, 2026 · Assigned by GitHub_M

CVE-2026-42225GnuTLS backend silently skips certificate chain verification when verify_peer is false

High 8.2

In plain English

A high-severity improper certificate validation in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.2%top 94.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport (sip_transport_tls) can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via verify_server = PJ_TRUE or verify_client = PJ_TRUE. This issue has been patched in version 2.17.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	asterisk	1:22.10.0+dfsg+~cs6.17.60671434-1	DEBIAN-CVE-2026-42225
Ubuntu:22.04:LTS	asterisk	no fix listed	UBUNTU-CVE-2026-42225
Ubuntu:24.04:LTS	asterisk	no fix listed	UBUNTU-CVE-2026-42225
Ubuntu:25.10	asterisk	no fix listed	UBUNTU-CVE-2026-42225
Ubuntu:26.04:LTS	asterisk	no fix listed	UBUNTU-CVE-2026-42225
Ubuntu:26.10	asterisk	no fix listed	UBUNTU-CVE-2026-42225

Affected products (as reported)

Vendor	Product	Versions
pjsip	pjproject	< 2.17

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/pjsip/pjproject/security/advisories/GHSA-x2fv-6j6c-pxmx x_refsource_CONFIRM
https://github.com/pjsip/pjproject/commit/ef684252bb62b0716675b6e99ad7fe4c90e28920 x_refsource_MISC
https://github.com/pjsip/pjproject/releases/tag/2.17 x_refsource_MISC