Live › vulnerability › CVE-2026-57187
Go to dashboardAsterisk's PJSIP handling of SDP over TCP can read freed memory when an authenticated client sends a SIP INVITE and disconnects before the 200 OK is sent. The reported effect is a crash, seen only in builds with Address Sanitizer, which the maintainer says production systems do not use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Systems running Asterisk with the PJSIP channel driver over connection-oriented transports (TCP or TLS) that accept INVITE requests from authenticated clients. Builds without Address Sanitizer, which the maintainer says is the normal production setup, are less likely to see a crash, but the bug is still present in the code. Deployments that only use UDP or do not accept SIP from authenticated clients can skip it.
No product ranges from the sources yet.
asterisk -V and compare it to the fixed releases.asterisk -rx "pjsip show transports", which lists TCP or TLS transports.20.20.1, 21.12.3, 22.10.1 or 23.4.1.20.7-cert11 or 22.8-cert3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with the 200 OK. So far, the crash has only been reproduced when Asterisk is built with Address Sanitizer, which detects the issue. Address Sanitizer is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.