AS
Product
asterisk
52
CVEs
0
On KEV
8.8
Max CVSS
20
New 30D
Severity mix
Critical 0High 16Medium 13Low 4
Watch
Add asterisk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23741 | 8.8 | Feb 6 | ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9 |
| CVE-2024-42365 | 8.8 | Aug 8 | Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan Affected: < 18.24.2; >= 19.0.0, < 20.9.2; >= 21.0.0, < 21.4.2; < 18.9-cert11; >= 19.0, < 20.7-cert2 |
| CVE-2026-57191 New | 8.2 | Oct 27 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57202 New | 8.1 | Oct 27 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-23740 | 7.8 | Feb 6 | Asterisk vulnerable to potential privilege escalation Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9 |
| CVE-2025-1131 | 7.8 | Sep 23 | Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation Affected: Asterisk <=18.26.2; Asterisk <= 20.15.0; Asterisk <= 21.10.0; Asterisk <= 22.5.0 |
| CVE-2025-47780 | 7.8 | May 22 | cli_permissions.conf: deny option does not work for disallowing shell commands Affected: < 18.9-cert14; >= 18.10, < 18.26.2; >= 20.0, < 20.7-cert5; >= 20.8, < 20.14.1; >= 21.0, < 21.9.1; >= 22.0, < 22.4.1 |
| CVE-2026-57197 New | 7.7 | Oct 27 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57186 New | 7.5 | Oct 27 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser Affected: >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57200 New | 7.5 | Oct 27 | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57195 New | 7.5 | Oct 27 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57201 New | 7.5 | Oct 27 | Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2025-57767 | 7.5 | Aug 28 | Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request Affected: < 22.5.2; < 21.10.2; < 20.15.2 |
| CVE-2026-57188 New | 7.1 | Oct 27 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57187 New | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57190 New | 7.0 | Oct 27 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
Showing 16