CVE-2026-57187: high-severity vulnerability in asterisk
Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.5%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Related CVEs — asterisk
In the same product, most dangerous first.
CVE-2023-49294MEDIUMAsterisk Path Traversal vulnerabilityEPSS 45.3%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2024-42365HIGHAsterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplanEPSS 4.7%CVE-2026-57193MEDIUMAsterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)EPSS 2.0%CVE-2009-3723—CVE-2009-3723EPSS 1.2%CVE-2023-37457HIGHAsterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'EPSS 1.1%
References
https://github.com/asterisk/asterisk/commit/0f076168e0be31ebee37762192d0ee049e9c0d42https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0https://github.com/asterisk/asterisk/commit/6e1f4df744369d66ea6f412e355d819b2a7bf26chttps://github.com/asterisk/asterisk/commit/9e0386c6d259f0c7499d52499d9891bee8a494fahttps://github.com/asterisk/asterisk/commit/b7ba85458796ef54b471017287c7806095dbda76https://github.com/asterisk/asterisk/commit/d4e30005940f86942745bcc64f34748d69870247https://github.com/asterisk/asterisk/commit/f1e47621472bb3d8ad71f32823f5ca986e008437https://github.com/asterisk/asterisk/releases/tag/20.20.1https://github.com/asterisk/asterisk/releases/tag/21.12.3https://github.com/asterisk/asterisk/releases/tag/22.10.1https://github.com/asterisk/asterisk/releases/tag/23.4.1https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11