CVE-2026-57187

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description An authenticated attacker can trigger a heap-use-after-free (a memory corruption issue where the program continues to use a pointer after the memory it points to has been freed) in PJSIP TCP/SDP handling. This occurs when a SIP INVITE is sent over a connection-oriented transport and the connection is closed before the system responds with a 200 OK. This issue has been reproduced in environments built with Address Sanitizer, a development tool used to detect memory errors.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 20.7-cert11 Update to Certified Asterisk version 22.8-cert3