TI-2025-35652 Aliases CVE-2025-57767

Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

LOW 39CWE-253Published 2025-08-28 · Updated 2025-08-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00425 36th percentileScored 2026-11-07

Fix Fixed asterisk (asterisk): 22.5.2, 21.10.2, 20.15.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
asterisk	asterisk	before 22.5.2; before 21.10.2; before 20.15.2	22.5.2, 21.10.2, 20.15.2	Patch available	CNA

asterisk Vendorasterisk Affected before 22.5.2; before 21.10.2; before 20.15.2 Fixed in 22.5.2, 21.10.2, 20.15.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sangoma:asterisk::::::::	before 20.15.2; 21.0.0 to before 21.10.2; 22.0.0 to before 22.5.2	Vulnerable	Sangoma

cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 20.15.2; 21.0.0 to before 21.10.2; 22.0.0 to before 22.5.2 Vulnerable ·Sangoma

Remediation

Fix · CNA asterisk (asterisk) Fixed in 22.5.2, 21.10.2, 20.15.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-57767

References

Patch 2

Advisory 1

https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j

TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5

See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences