{"id":"CVE-2026-57191","kind":"vulnerability","aliases":["CVE-2026-57191"],"related":[],"title":"Asterisk: unbounded sscanf in MWI NOTIFY lets unauthenticated packets crash SIP","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"Asterisk's res_pjsip_pubsub module parses the Message-Account field of MWI NOTIFY messages with an unbounded sscanf, causing a stack buffer overflow. An unauthenticated attacker can send a crafted SIP packet that corrupts the transport and permanently disables all SIP functionality until Asterisk is restarted.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","package","self-hosted","sip","telephony","voip"],"not_affected_if":["no-pjsip","patched-version","sip-not-exposed"],"how_to_check":"- Check the installed Asterisk version with `asterisk -V` and compare against the fixed releases listed below.\n- Confirm whether the PJSIP stack and the res_pjsip_pubsub module are loaded with `asterisk -rx \"module show like pubsub\"`.","fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1` for the mainline releases.\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.\n- Restart Asterisk after upgrading to restore SIP service if it was already disabled.","status":"open","published_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","triaged_at":"2026-10-27T22:30:13+00:00","updated_at":"2026-10-27T22:30:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T22:30:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1` for the mainline releases.\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`.\n- Restart Asterisk after upgrading to restore SIP service if it was already disabled.","reach":"network","title":"Asterisk: unbounded sscanf in MWI NOTIFY lets unauthenticated packets crash SIP","impact":"medium","summary":"Asterisk's res_pjsip_pubsub module parses the Message-Account field of MWI NOTIFY messages with an unbounded sscanf, causing a stack buffer overflow. An unauthenticated attacker can send a crafted SIP packet that corrupts the transport and permanently disables all SIP functionality until Asterisk is restarted.","category":"package","nicknames":[],"who_cares":["asterisk","voip","sip","self-hosted","telephony"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker permanently disables all SIP functionality until restart","analyst_note":"","how_to_check":"- Check the installed Asterisk version with `asterisk -V` and compare against the fixed releases listed below.\n- Confirm whether the PJSIP stack and the res_pjsip_pubsub module are loaded with `asterisk -rx \"module show like pubsub\"`.","needs_analyst":false,"not_affected_if":["patched-version","no-pjsip","sip-not-exposed"],"who_is_affected":"Systems running Asterisk versions before the fixed releases with the PJSIP channel driver handling SIP MWI subscriptions are exposed. Deployments that expose the SIP port to untrusted networks face the highest risk. Teams running patched versions or without SIP reachable from the internet have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3486,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57191':14A,17A '20.20.1':88C,157C '20.7':95C,164C '21.12.3':89C,158C '22.10.1':90C,159C '22.8':97C,166C '23.4.1':91C,160C 'account':36B,113C 'allow':116C 'asterisk':1A,18B,26B,71B,74C,87C,94C,143C,156C,163C 'attack':53B,119C 'branch':80C 'buffer':49B,130C 'care':123C 'caus':46B,127C 'cert11':96C,165C 'cert3':98C,167C 'certifi':93C,162C 'corrupt':61B,133C 'craft':57B,124C 'crash':10A 'cve':12A,15A 'disabl':66B,138C 'exchang':81C 'field':37B,114C 'fix':154C 'full':149C 'function':69B,141C 'host':22B 'issu':152C 'let':7A 'may':115C 'messag':35B,41B,112C 'message-account':34B,111C 'modul':31B 'mwi':5A,39B,109C 'notifi':6A,40B,110C 'open':77C 'oper':150C 'overflow':50B,131C 'packag':19B 'packet':9A,59B,125C 'pars':32B,107C 'perman':65B,137C 'pjsip':29B,104C 'prior':85C 'privat':79C 'pubsub':30B,105C 'requir':146C 'res':28B,103C 'restart':73B,144C 'restor':148C 'self':21B 'self-host':20B 'send':55B,121C 'sip':11A,23B,58B,68B,140C 'sourc':78C 'sscanf':3A,45B,101C 'stack':48B,129C 'telephoni':24B,83C 'toolkit':84C 'transport':63B,136C 'unauthent':8A,52B,118C 'unbound':2A,44B,100C 'under':135C 'voip':25B","nicknames":[],"mitigations":[],"who_affected":"Systems running Asterisk versions before the fixed releases with the PJSIP channel driver handling SIP MWI subscriptions are exposed. Deployments that expose the SIP port to untrusted networks face the highest risk. Teams running patched versions or without SIP reachable from the internet have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57191","severity":null,"published_at":"2026-10-27T22:17:27+00:00","modified_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","fetched_at":"2026-10-27T22:29:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}