---
id: "CVE-2026-57188"
kind: "vulnerability"
aliases: ["CVE-2026-57188"]
title: "Asterisk: XMPP namespace handling lets an authenticated peer overflow the stack"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asterisk", "package", "self-hosted", "telephony", "voip"]
not_affected_if: ["res-xmpp-not-loaded", "xmpp-not-configured"]
published_at: "2026-10-27T18:17:37+00:00"
first_seen_at: "2026-10-27T18:33:00+00:00"
updated_at: "2026-10-27T18:34:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57188", "first_seen_at": "2026-10-27T18:33:00+00:00"}]
---

# Asterisk: XMPP namespace handling lets an authenticated peer overflow the stack

Asterisk's res_xmpp module mishandles XMPP namespace prefixes, allowing a stack buffer overflow when crafted packets are processed. An attacker with an XMPP account on the same or a federated server can trigger it, and the sources do not state whether code execution is achievable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `asterisk -V` and compare against the fixed versions.
- Check `xmpp.conf` for a configured XMPP connection and confirm `res_xmpp` is loaded with `asterisk -rx "module show like res_xmpp"`.
- Only systems with both of these are exposed.

## Fix

- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`.
- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.
- Alternatively, unload `res_xmpp` or remove the XMPP connection from `xmpp.conf` until patched.

## Timeline

- 2026-10-27T18:33:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57188

## From the sources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_