CVE-2022-23608

PJSIP has a use-after-free in dialog-set (forking) scenarios: a hash key shared by multiple UAC dialogs can be freed prematurely when one dialog is destroyed, which can register a dialog set in the hash table multiple times and lead to undefined behavior — dialog list collisions that end in an endless loop. PJSIP underpins SIP/VoIP stacks, so the practical impact is a remotely triggerable path to memory corruption and denial of service in telephony infrastructure, with the ceiling of undefined behavior that use-after-free implies.

The vector marks high attack complexity, and the description explains why: it depends on a specific forking/dialog-set condition and a particular destruction ordering, not a single trivial packet. So while it's network-reachable and unauthenticated, reliably driving the use-after-free takes more than spray-and-pray — this is a capable attacker targeting a SIP service, not a botnet one-liner. Where it lands, a hung or crashed voice service is a genuine availability hit for anyone relying on that telephony path, and memory corruption always carries a worse-case tail.

Because PJSIP is an embedded library, our handling is dependency inventory across the products that bundle it — the CVE spans Asterisk, Certified Asterisk, Debian, and PJSIP itself. The work is mapping which VoIP systems in the estate build on the affected 2.11.1-or-earlier library and getting them onto builds that include the fix commit. There are no vendor workarounds per the advisory, so patching is the only real remedy; we rank it by whether the SIP service is exposed to untrusted callers versus confined to a trusted voice network.