Asterisk is an open source private branch exchange and telephony toolkit.
CVE-2026-57187
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with the 200 OK. So far, the crash has only been reproduced when Asterisk is built with Address Sanitizer, which detects the issue. Address Sanitizer is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Assessment
- CVSS
- 7.1 (v4.0)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 27 October 2026
- Weakness
- CWE-416, CWE-664
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
- https://github.com/asterisk/asterisk/commit/0f076168e0be31ebee37762192d0ee049e9c0d42
- https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0
- https://github.com/asterisk/asterisk/commit/6e1f4df744369d66ea6f412e355d819b2a7bf26c
- https://github.com/asterisk/asterisk/commit/9e0386c6d259f0c7499d52499d9891bee8a494fa
- https://github.com/asterisk/asterisk/commit/b7ba85458796ef54b471017287c7806095dbda76
- https://github.com/asterisk/asterisk/commit/d4e30005940f86942745bcc64f34748d69870247
- https://github.com/asterisk/asterisk/commit/f1e47621472bb3d8ad71f32823f5ca986e008437
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-57187