Live › vulnerability › CVE-2026-57191
Go to dashboardAsterisk's res_pjsip_pubsub module parses the Message-Account field of MWI NOTIFY messages with an unbounded sscanf, causing a stack buffer overflow. An unauthenticated attacker can send a crafted SIP packet that corrupts the transport and permanently disables all SIP functionality until Asterisk is restarted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 22:29 UTC. All times on this page are UTC.
Systems running Asterisk versions before the fixed releases with the PJSIP channel driver handling SIP MWI subscriptions are exposed. Deployments that expose the SIP port to untrusted networks face the highest risk. Teams running patched versions or without SIP reachable from the internet have less exposure.
No product ranges from the sources yet.
asterisk -V and compare against the fixed releases listed below.asterisk -rx "module show like pubsub".20.20.1, 21.12.3, 22.10.1 or 23.4.1 for the mainline releases.20.7-cert11 or 22.8-cert3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.