{"api_version":"1","generated_at":"2026-07-24T23:41:14+00:00","cve":"CVE-2021-21375","urls":{"html":"https://cve.report/CVE-2021-21375","api":"https://cve.report/api/cve/CVE-2021-21375.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-21375","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-21375"},"summary":{"title":"CVE-2021-21375","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-03-10 23:15:00","updated_at":"2022-10-21 22:40:00"},"problem_types":["CWE-754"],"metrics":[],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html","name":"[debian-lts-announce] 20210423 [SECURITY] [DLA 2636-1] pjproject security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2636-1] pjproject security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365","name":"https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Merge pull request from GHSA-hvq6-f89p-frvp · pjsip/pjproject@97b3d7a · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp","name":"https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp","refsource":"CONFIRM","tags":["Exploit","Patch","Third Party Advisory"],"title":"Crash in receiving updated SDP answer after initial SDP negotiation failed · Advisory · pjsip/pjproject · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00020.html","name":"[debian-lts-announce] 20210523 [SECURITY] [DLA 2665-1] ring security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2665-1] ring security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202107-42","name":"GLSA-202107-42","refsource":"GENTOO","tags":[],"title":"PJSIP: Multiple vulnerabilities (GLSA 202107-42) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21375","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21375","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"21375","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"21375","vulnerable":"1","versionEndIncluding":"2.1.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teluu","cpe5":"pjsip","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"21375","vulnerable":"1","versionEndIncluding":"2.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teluu","cpe5":"pjsip","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-21375","qid":"178555","title":"Debian Security Update for pjproject (DLA 2636-1)"},{"cve":"CVE-2021-21375","qid":"178611","title":"Debian Security Update for ring (DLA 2665-1)"},{"cve":"CVE-2021-21375","qid":"179768","title":"Debian Security Update for ring (CVE-2021-21375)"},{"cve":"CVE-2021-21375","qid":"501762","title":"Alpine Linux Security Update for pjproject"},{"cve":"CVE-2021-21375","qid":"504290","title":"Alpine Linux Security Update for pjproject"},{"cve":"CVE-2021-21375","qid":"710027","title":"Gentoo Linux PJSIP Multiple vulnerabilities (GLSA 202107-42)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-21375","STATE":"PUBLIC","TITLE":"Crash in receiving updated SDP answer after initial SDP negotiation failed"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"pjproject","version":{"version_data":[{"version_value":"<= 2.10"}]}}]},"vendor_name":"pjsip"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-400 Uncontrolled Resource Consumption"}]}]},"references":{"reference_data":[{"name":"https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp","refsource":"CONFIRM","url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-hvq6-f89p-frvp"},{"name":"https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365","refsource":"MISC","url":"https://github.com/pjsip/pjproject/commit/97b3d7addbaa720b7ddb0af9bf6f3e443e664365"},{"refsource":"MLIST","name":"[debian-lts-announce] 20210423 [SECURITY] [DLA 2636-1] pjproject security update","url":"https://lists.debian.org/debian-lts-announce/2021/04/msg00023.html"},{"refsource":"MLIST","name":"[debian-lts-announce] 20210523 [SECURITY] [DLA 2665-1] ring security update","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00020.html"},{"refsource":"GENTOO","name":"GLSA-202107-42","url":"https://security.gentoo.org/glsa/202107-42"}]},"source":{"advisory":"GHSA-hvq6-f89p-frvp","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-03-10 23:15:00","lastModifiedDate":"2022-10-21 22:40:00","problem_types":["CWE-754"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*","versionEndIncluding":"2.10","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"21375","Ordinal":"195501","Title":"CVE-2021-21375","CVE":"CVE-2021-21375","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"21375","Ordinal":"1","NoteData":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP version 2.10 and earlier, after an initial INVITE has been sent, when two 183 responses are received, with the first one causing negotiation failure, a crash will occur. This results in a denial of service.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"21375","Ordinal":"2","NoteData":"2021-03-10","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"21375","Ordinal":"3","NoteData":"2021-07-20","Type":"Other","Title":"Modified"}]}}}