Vulnerability DatabaseCVE-2026-57195
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-57195
Published:October 27, 2026
Updated:October 28, 2026
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the "Asterisk Manager Interface (AMI)" may allow an unauthenticated attacker to crash Asterisk when "Digest Authentication" is used via "HTTP". The Asterisk "HTTP" web server, AMI, and AMI access via "HTTP" must all be enabled; each is disabled by default. The attacker must be able to connect to the "HTTP" server, which binds only to "127.0.0.1" by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Packages
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=certified-20.7-cert1-rc1 <certified-20.7-cert11
Fix Suggestion:
Update to version certified-20.7-cert11
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=23.0.0-rc1 <23.4.1
Fix Suggestion:
Update to version 23.4.1
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=certified-22.8-cert1-rc1 <certified-22.8-cert3
Fix Suggestion:
Update to version certified-22.8-cert3
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=22.0.0-rc1 <22.10.1
Fix Suggestion:
Update to version 22.10.1
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=21.0.0-rc1 <21.12.3
Fix Suggestion:
Update to version 21.12.3
https://github.com/asterisk/asterisk.git (GITHUB):
Affected version(s) >=20.0.0-rc1 <20.20.1
Fix Suggestion:
Update to version 20.20.1
Related Resources (15)
https://github.com/asterisk/asterisk/commit/5d5d8d8ef7f16774820b1889ae73d8d2ab14af45
https://github.com/asterisk/asterisk/commit/a1fcfdf9b91ed58cc8fb9da8d135da60bae7345d
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
https://github.com/asterisk/asterisk/commit/10c5b2efcacab03bf04a229f81cc24e76fe42c41
https://github.com/asterisk/asterisk/commit/362ef847e7e057b7626e476ddcfe7328ea314db4
https://github.com/asterisk/asterisk/releases/tag/22.10.1
https://github.com/asterisk/asterisk/security/advisories/GHSA-3rhj-hhw7-m6fw
https://github.com/asterisk/asterisk/releases/tag/23.4.1
https://github.com/asterisk/asterisk/tree/24.0.0-pre1
https://github.com/asterisk/asterisk/commit/87a1f43e4c465b885163665aa89172ed0f392663
https://github.com/asterisk/asterisk/commit/abba42c58fee2226a709583afdbeec75cf1dde8b
https://github.com/asterisk/asterisk/commit/fff89162cdd702e8a143701f138edd8dceab154f
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
https://github.com/asterisk/asterisk/releases/tag/21.12.3
https://github.com/asterisk/asterisk/releases/tag/20.20.1
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
NULL Pointer Dereference
CWE-476