Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-57187EUVD-2026-110076GHSA-G8Q2-P36Q-94F6

Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

Asterisk, an open source telephony toolkit, is affected through its PJSIP channel driver's TCP and SDP handling. An authenticated attacker who sends a SIP INVITE over a TCP connection and disconnects before Asterisk replies can trigger a memory-safety error that may crash the service, though this has only been reproduced in builds using Address Sanitizer.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • asterisk asterisk

    fixed in 20.20.1; From 21.0.0-pre1 · fixed in 21.12.3; From 22.0.0-pre1 · fixed in 22.10.1; From 23.0.0-pre1 · fixed in 23.4.1

  • asterisk certified-asterisk

    fixed in 20.7-cert11; From 22.8-cert1-pre1 · fixed in 22.8-cert3

References 15

GitHub · asterisk/asterisk