Read the docs
TI-2026-19112 Aliases CVE-2026-23739

Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

Priority LOW 28CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can allow an attacker to trigger XML External Entity (XXE) or XInclude-based local file disclosure, potentially exposing sensitive files from the host system. This can also be triggered in other cases in which the user is able to supply input in xml format that triggers the asterisk process to parse it. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 23.2.2, 22.8.2, 21.12.1 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert923.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9Patch availableCNA
  • asterisk Vendorasterisk Affected before 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert9 Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*up to 18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*20.7 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*20.7 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*20.7 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*20.7 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*20.7 cert6VulnerableSangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* Versions up to 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* Versions 20.7 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* Versions 20.7 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:* Versions 20.7 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:* Versions 20.7 cert6 Vulnerable ·Sangoma
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*20.7 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:*20.7 cert8VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:* Versions 20.7 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:* Versions 20.7 cert8 Vulnerable ·Sangoma

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23739

References

Advisory 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences