Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-57193EUVD-2026-110081GHSA-R6C2-HWC2-J4MP

Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

Asterisk, an open source telephony toolkit, is affected when its LDAP realtime driver (res_config_ldap) is loaded and configured to use an LDAP server, which is not the default setup. An unauthenticated attacker can send crafted SIP packets with a malicious username to run arbitrary LDAP queries and obtain sensitive directory information.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • asterisk asterisk

    fixed in 20.20.1; From 21.0.0-pre1 · fixed in 21.12.3; From 22.0.0-pre1 · fixed in 22.10.1; From 23.0.0-pre1 · fixed in 23.4.1

  • asterisk certified-asterisk

    fixed in 20.7-cert11; From 22.8-cert1-pre1 · fixed in 22.8-cert3

References 15

GitHub · asterisk/asterisk