---
id: "CVE-2026-57187"
kind: "vulnerability"
aliases: ["CVE-2026-57187"]
title: "Asterisk PBX: PJSIP TCP/SDP use-after-free crashes server after INVITE disconnect"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["asterisk", "pjsip", "runtime", "self-hosted", "sip-trunking", "voip"]
not_affected_if: ["chan-sip-only", "no-tcp-transport", "udp-only"]
published_at: "2026-10-26T20:17:56+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57187", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# Asterisk PBX: PJSIP TCP/SDP use-after-free crashes server after INVITE disconnect

Asterisk's PJSIP handling of SDP over TCP can read freed memory when an authenticated client sends a SIP INVITE and disconnects before the 200 OK is sent. The reported effect is a crash, seen only in builds with Address Sanitizer, which the maintainer says production systems do not use.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `asterisk -V` and compare it to the fixed releases.
- Confirm whether the PJSIP stack is in use with `asterisk -rx "pjsip show transports"`, which lists TCP or TLS transports.

## Fix

- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`.
- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57187

## From the sources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_