Live › vulnerability › CVE-2026-57195
Go to dashboardA NULL pointer dereference in the Asterisk Manager Interface, reached over HTTP with Digest Authentication, lets an unauthenticated attacker crash Asterisk. The sources describe a denial of service, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Only systems running Asterisk with the HTTP server, AMI and AMI-over-HTTP all enabled, with Digest Authentication in use, are exposed. The HTTP server binds to localhost by default, so exposure needs a deliberately reachable bind address. Systems that keep the defaults can skip the emergency patch but should still upgrade.
No product ranges from the sources yet.
asterisk -rx "core show version" to read the installed version.http.conf for enabled=yes and manager.conf for enabled=yes and webenabled=yes; all three must be on for exposure.http.conf; the default is 127.0.0.1.20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk to 20.7-cert11 or 22.8-cert3.webenabled=no in manager.conf) or disable the HTTP server.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP. The Asterisk HTTP web server, AMI, and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.