CVE-2026-57188
Severity not reportedAsterisk is an open source private branch exchange and telephony toolkit.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/asterisk/asterisk/commit/12072a559f592736a44dd9fbe1594e84714edfb4 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/1328dbb503da4aa11a480a9c28e170f17e5f4e84 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/3c4b08cf94eeaa3faefb3ae6c2d6ce1bd9747a13 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/433102c16b8edfc31d28c96166fef03fe72fb923 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/5e626250628b2579530f3f17e7b0aa37d082873b security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/d570a85e45153a36919ace5d0ab06a195b30f9d1 security-advisories@github.com
- https://github.com/asterisk/asterisk/commit/e329a6803ac5214028f98cc5f0b7167d66e32c08 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/20.20.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 security-advisories@github.com
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 security-advisories@github.com
- https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f security-advisories@github.com
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 security-advisories@github.com