Live › vulnerability › CVE-2026-57188
Go to dashboardAsterisk's res_xmpp module mishandles XMPP namespace prefixes, allowing a stack buffer overflow when crafted packets are processed. An attacker with an XMPP account on the same or a federated server can trigger it, and the sources do not state whether code execution is achievable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:33 UTC. All times on this page are UTC.
Only Asterisk deployments that load the res_xmpp module and have an XMPP connection configured in xmpp.conf are exposed. The attacker must hold an XMPP account on the same server or a federated one, so systems without XMPP can skip it.
No product ranges from the sources yet.
asterisk -V and compare against the fixed versions.xmpp.conf for a configured XMPP connection and confirm res_xmpp is loaded with asterisk -rx "module show like res_xmpp".20.20.1, 21.12.3, 22.10.1 or 23.4.1.20.7-cert11 or 22.8-cert3.res_xmpp or remove the XMPP connection from xmpp.conf until patched.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling using carefully crafted packets. The res_xmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57188")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.