Heap-use-after-free in Asterisk PJSIP TCP/SDP handling
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
Asterisk is affected before 20.20.1, from 21.0.0-pre1 before 21.12.3, from 22.0.0-pre1 before 22.10.1, and from 23.0.0-pre1 before 23.4.1, and Certified Asterisk is affected before 20.7-cert11 and from 22.8-cert1-pre1 before 22.8-cert3. A heap-use-after-free (CWE-416) in PJSIP TCP/SDP handling occurs when a connection closes during SDP processing. An authenticated attacker can trigger it by sending a SIP INVITE over a connection-oriented transport and disconnecting before the 200 OK.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| asterisk | asterisk | before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 | 20.20.1, 21.12.3, 22.10.1, 23.4.1 | Patch available | CNA |
| asterisk | certified-asterisk | before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 | 20.7-cert11, 22.8-cert3 | Patch available | CNA |
- asterisk Vendorasterisk Affected before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1 Patch available CNA
- certified-asterisk Vendorasterisk Affected before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 20.7-cert11, 22.8-cert3 Patch available CNA
Remediation
Upgrade Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1. Upgrade Certified Asterisk to 20.7-cert11 or 22.8-cert3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA asterisk (asterisk) Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1
- Fix · CNA certified-asterisk (asterisk) Fixed in 20.7-cert11, 22.8-cert3
Vendor assessments
Timeline
- 2026-10-26 Threatist record created from CVE-2026-57187
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
- 2026-11-02 CISA SSVC decision points changed
References
Other 15
- https://github.com/asterisk/asterisk/security/advisories/GHSA-g8q2-p36q-94f6
- https://github.com/asterisk/asterisk/commit/0f076168e0be31ebee37762192d0ee049e9c0d42
- https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0
- https://github.com/asterisk/asterisk/commit/6e1f4df744369d66ea6f412e355d819b2a7bf26c
- https://github.com/asterisk/asterisk/commit/9e0386c6d259f0c7499d52499d9891bee8a494fa
- https://github.com/asterisk/asterisk/commit/b7ba85458796ef54b471017287c7806095dbda76
- https://github.com/asterisk/asterisk/commit/d4e30005940f86942745bcc64f34748d69870247
- https://github.com/asterisk/asterisk/commit/f1e47621472bb3d8ad71f32823f5ca986e008437
- https://github.com/asterisk/asterisk/releases/tag/20.20.1
- https://github.com/asterisk/asterisk/releases/tag/21.12.3
- https://github.com/asterisk/asterisk/releases/tag/22.10.1
- https://github.com/asterisk/asterisk/releases/tag/23.4.1
- https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1
More asterisk vulnerabilities
- TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
- TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
- TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
- TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
- TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-57187 · CVE Program
- CVE-2026-57187 · NVD
- FIRST EPSS
- CVE-2026-57187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences