Login Request a demo
AS
Product
asterisk
by asterisk · last CVE Oct 27, 2026
51
CVEs
0
On KEV
8.8
Max CVSS
20
New 30D
Vulnerabilities51In the news0Timeline
Severity mix
Critical 0High 16Medium 12Low 4
Severity
All severities51Critical0High16Medium12Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add asterisk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-57203
New
6.9
0%
Oct 27
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57193
New
6.9
2%
Oct 26
Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57185
New
6.5
0%
Oct 27
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-23739
6.5
0%
Feb 6
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9
CVE-2025-54995
6.5
1%
Aug 28
Asterisk remotely exploitable leak of RTP UDP ports and internal resources
Affected: < 18.26.4; < 18.9-cert17
CVE-2025-49832
6.5
0%
Aug 1
Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation
Affected: < 18.26.3; >= 20.00.0, < 20.15.1; >= 21.00.0, < 21.10.1; >= 22.00.0, < 22.5.1; >= 20.7-cert6, < 20.7-cert7
CVE-2025-47779
6.5
1%
May 22
Using malformed From header can forge identity with ";" or NULL in name portion
Affected: < 18.9-cert14; >= 18.10, < 18.26.2; >= 20.0, < 20.7-cert5; >= 20.8, < 20.14.1; >= 21.0, < 21.9.1; >= 22.0, < 22.4.1
CVE-2026-57184
New
6.3
1%
Oct 26
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-23738
6.1
0%
Feb 6
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Affected: < 23.2.2; < 22.8.2; < 21.12.1; < 20.18.2; < 20.7-cert9
CVE-2026-57192
New
6.0
1%
Oct 27
Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2026-57194
New
5.9
0%
Oct 27
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1
CVE-2024-42491
5.7
1%
Sep 5
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Affected: < 18.24.3; >= 19.0.0, < 20.9.3; >= 21.0.0, < 21.4.3; < 18.9-cert12; >= 19.0, < 20.7-cert2
Showing 12