CVE-2026-57191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57191", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.799Z", "datePublished": "2026-10-27T21:32:23.714Z", "dateUpdated": "2026-11-02T19:45:36.758Z"}, "containers": {"cna": {"title": "Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing", "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx"}, {"name": "https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528"}, {"name": "https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b"}, {"name": "https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0"}, {"name": "https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b"}, {"name": "https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd"}, {"name": "https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a"}, {"name": "https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"version": "< 20.7-cert11", "status": "affected"}, {"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:32:23.714Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "source": {"advisory": "GHSA-589g-qgf8-m6mx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:45:27.310579Z", "id": "CVE-2026-57191", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:45:36.758Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:45:27.310579Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:45:32.521Z"}}], "cna": {"title": "Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing", "source": {"advisory": "GHSA-589g-qgf8-m6mx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "references": [{"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx", "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528", "name": "https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b", "name": "https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0", "name": "https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b", "name": "https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd", "name": "https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a", "name": "https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75", "name": "https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T21:32:23.714Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57191", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:45:36.758Z", "dateReserved": "2026-06-24T02:00:46.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T21:32:23.714Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"product": "certified-asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "id": "CVE-2026-57191", "lastModified": "2026-11-02T20:17:45.527", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57191", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:45:27.310579Z", "version": "2.0.3"}}]}, "published": "2026-10-27T22:17:27.390", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asterisk: Asterisk: Denial of Service via stack-based buffer overflow in res_pjsip_pubsub", "id": "2565372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565372"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.", "A flaw was found in Asterisk. An unbounded string parsing vulnerability in the res_pjsip_pubsub module allows an unauthenticated remote attacker to trigger a stack-based buffer overflow by sending a specially crafted Message Waiting Indication (MWI) NOTIFY packet. Successful exploitation leads to a Denial of Service (DoS) by corrupting the network transport and disabling all Session Initiation Protocol (SIP) functionality until the service is restarted."], "name": "CVE-2026-57191", "public_date": "2026-10-27T21:32:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57191\nhttps://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528\nhttps://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b\nhttps://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0\nhttps://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b\nhttps://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd\nhttps://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a\nhttps://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75\nhttps://github.com/asterisk/asterisk/releases/tag/20.20.1\nhttps://github.com/asterisk/asterisk/releases/tag/21.12.3\nhttps://github.com/asterisk/asterisk/releases/tag/22.10.1\nhttps://github.com/asterisk/asterisk/releases/tag/23.4.1\nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nhttps://github.com/asterisk/asterisk/security/advisories/GHSA-589g-qgf8-m6mx\nhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger a denial of service across all SIP communications without user interaction, although it does not allow data compromise or code execution. Asterisk is not included in core Red Hat Enterprise Linux releases, though it is distributed via community channels like EPEL and Fedora. Deployments utilizing the PJSIP stack and handling inbound Message Waiting Indication (MWI) NOTIFY requests are susceptible to transport corruption that halts telephony operations until the service is restarted.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.20.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-pre1,21.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-pre1,22.10.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-pre1,23.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "asterisk", "source": "cna", "vendor": "asterisk"}, "product": "asterisk", "vendor": "asterisk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20.7-cert11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[22.8-cert1-pre1,22.8-cert3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "certified-asterisk", "source": "cna", "vendor": "asterisk"}, "product": "certified_asterisk", "vendor": "asterisk"}], "created": "2026-10-27T22:45:09.471088+00:00", "updated": "2026-10-27T23:00:16.781006+00:00", "vendors": ["asterisk", "asterisk$PRODUCT$asterisk", "asterisk$PRODUCT$certified_asterisk"]}