CVE-2026-57185
mediumAsterisk is an open source private branch exchange and telephony toolkit.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP MWI body parser` by sending a carefully crafted `SIP NOTIFY` request. The attacker must pass SIP authentication using either a username/password or `source IP address matching`. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/asterisk/asterisk/commit/07aec894a1fdfa7fa989d3ab40fdf0dcda8005bb security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/1039bed76fa3248f58b6880e4b3f1421ef98b01f security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/1b2d99d8eb9206d37fd47115996f67fd28bd056f security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/3100a0d331affbf0995b8c57aaddb31cf3971f6e security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/57ce484a45b098de417f19265c95c64497782e36 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/919f2ffda03329c9014bedcb3c7789d38660c9ed security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/dafff9fb60281817225f1ce6371a5aa2fbb967a4 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 security-advisories@github.com
- https://github.com/asterisk/asterisk/security/advisories/GHSA-8jw3-ccr9-xrmf security-advisories@github.com
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 security-advisories@github.com