Live › vulnerability › CVE-2026-57185
Go to dashboardAsterisk's PJSIP MWI body parser reads past the end of a buffer when handling a crafted SIP NOTIFY request. An authenticated attacker can crash the Asterisk process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Systems running Asterisk with the PJSIP channel driver, where SIP peers can authenticate with a username and password or are matched by source IP address. The attacker must pass SIP authentication first, so exposure is limited to trusted or authenticated peers. Deployments using only chan_sip or without PJSIP trunks or endpoints can skip it.
No product ranges from the sources yet.
asterisk -V and compare against the fixed versions: 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11 and 22.8-cert3.pjsip show endpoints); the MWI body parser is part of the PJSIP channel driver.20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk to 20.7-cert11 or 22.8-cert3, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully crafted SIP NOTIFY request. The attacker must pass SIP authentication using either a username/password or source IP address matching. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.