Read the docs
TI-2024-28459 Aliases CVE-2024-42491

NULL pointer dereference in asterisk

Priority LOW 26CWE-252Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00581 48th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 18.24.3, 20.9.3, 21.4.3 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 18.24.3; 19.0.0 to before 20.9.3; 21.0.0 to before 21.4.3; before 18.9-cert12; 19.0 to before 20.7-cert218.24.3, 20.9.3, 21.4.3, 18.9-cert12, 20.7-cert2Patch availableCNA
  • asterisk Vendorasterisk Affected before 18.24.3; 19.0.0 to before 20.9.3; 21.0.0 to before 21.4.3; before 18.9-cert12; 19.0 to before 20.7-cert2 Fixed in 18.24.3, 20.9.3, 21.4.3, 18.9-cert12, 20.7-cert2 Patch available CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 18.24.3; 20.0.0 to before 20.9.3; 21.0.0 – 21.4.3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*before 18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:*18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*18.9 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:*18.9 cert10VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:*18.9 cert11VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4VulnerableSangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 18.24.3; 20.0.0 to before 20.9.3; 21.0.0 – 21.4.3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* Versions before 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:-:*:*:*:*:*:* Versions 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert11:*:*:*:*:*:* Versions 18.9 cert11 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·Sangoma
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:*18.9 cert6VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:*18.9 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:*18.9 cert8VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*18.9 cert8-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*18.9 cert8-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:*18.9 cert9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*20.7 cert2VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 18.24.3, 20.9.3, 21.4.3, 18.9-cert12, 20.7-cert2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42491

References

Patch 5

Advisory 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences