{"id":"CVE-2026-57187","kind":"vulnerability","aliases":["CVE-2026-57187"],"related":[],"title":"Asterisk PBX: PJSIP TCP/SDP use-after-free crashes server after INVITE disconnect","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"Asterisk's PJSIP handling of SDP over TCP can read freed memory when an authenticated client sends a SIP INVITE and disconnects before the 200 OK is sent. The reported effect is a crash, seen only in builds with Address Sanitizer, which the maintainer says production systems do not use.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","pjsip","runtime","self-hosted","sip-trunking","voip"],"not_affected_if":["chan-sip-only","no-tcp-transport","udp-only"],"how_to_check":"- Check the installed version with `asterisk -V` and compare it to the fixed releases.\n- Confirm whether the PJSIP stack is in use with `asterisk -rx \"pjsip show transports\"`, which lists TCP or TLS transports.","fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`.\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.","status":"open","published_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:37+00:00","updated_at":"2026-10-26T20:51:37+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-26T20:51:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`.\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.","reach":"network","title":"Asterisk PBX: PJSIP TCP/SDP use-after-free crashes server after INVITE disconnect","impact":"medium","summary":"Asterisk's PJSIP handling of SDP over TCP can read freed memory when an authenticated client sends a SIP INVITE and disconnects before the 200 OK is sent. The reported effect is a crash, seen only in builds with Address Sanitizer, which the maintainer says production systems do not use.","category":"runtime","nicknames":[],"who_cares":["asterisk","pjsip","voip","self-hosted","sip-trunking"],"confidence":0.7,"needs_auth":"yes","worst_case":"Remote attacker with credentials crashes the Asterisk service","analyst_note":"","how_to_check":"- Check the installed version with `asterisk -V` and compare it to the fixed releases.\n- Confirm whether the PJSIP stack is in use with `asterisk -rx \"pjsip show transports\"`, which lists TCP or TLS transports.","needs_analyst":false,"not_affected_if":["udp-only","chan-sip-only","no-tcp-transport"],"who_is_affected":"Systems running Asterisk with the PJSIP channel driver over connection-oriented transports (TCP or TLS) that accept INVITE requests from authenticated clients. Builds without Address Sanitizer, which the maintainer says is the normal production setup, are less likely to see a crash, but the bug is still present in the code. Deployments that only use UDP or do not accept SIP from authenticated clients can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":3522,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-57187':16A,19A '20.20.1':94C,186C '20.7':101C,193C '200':54B,138C '21.12.3':95C,187C '22.10.1':96C,188C '22.8':103C,195C '23.4.1':97C,189C 'accord':170C 'address':69B,153C,159C 'asterisk':1A,20B,30B,80C,93C,100C,134C,149C,185C,192C 'attack':107C 'authent':44B,106C 'branch':86C 'build':67B 'built':151C 'caus':109C 'cert11':102C,194C 'cert3':104C,196C 'certifi':99C,191C 'client':45B 'connect':128C 'connection-ori':127C 'crash':9A,63B,143C 'cve':14A,17A 'detect':156C 'develop':163C 'disconnect':13A,51B,132C 'effect':60B 'exchang':87C 'far':141C 'fix':183C 'free':8A,115C 'freed':40B 'handl':33B,119C 'heap':112C 'heap-use-after-fre':111C 'host':25B 'invit':12A,49B,124C 'issu':158C,181C 'maintain':73B,173C 'may':108C 'memori':41B 'ok':55B,139C 'open':83C 'orient':129C 'overhead':168C 'pbx':2A 'perform':167C 'pjsip':3A,21B,32B,117C 'prior':91C 'privat':85C 'product':75B,178C 'read':39B 'report':59B 'reproduc':147C 'respond':135C 'runtim':22B 'sanit':70B,154C,160C 'say':74B 'sdp':35B 'seen':64B 'self':24B 'self-host':23B 'send':46B,121C 'sent':57B 'server':10A 'signific':166C 'sip':27B,48B,123C 'sip-trunk':26B 'sourc':84C 'system':76B,179C 'tcp':37B 'tcp/sdp':4A,118C 'telephoni':89C 'tool':164C 'toolkit':90C 'transport':130C 'trunk':28B 'use':6A,79B,113C,176C 'use-after-fre':5A 'voip':29B","nicknames":[],"mitigations":[],"who_affected":"Systems running Asterisk with the PJSIP channel driver over connection-oriented transports (TCP or TLS) that accept INVITE requests from authenticated clients. Builds without Address Sanitizer, which the maintainer says is the normal production setup, are less likely to see a crash, but the bug is still present in the code. Deployments that only use UDP or do not accept SIP from authenticated clients can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57187","severity":null,"published_at":"2026-10-26T20:17:56+00:00","modified_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}