CVE-2026-57185

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description An authenticated attacker can cause a crash by sending a specially crafted SIP NOTIFY request. This occurs due to a buffer over-read in the PJSIP MWI body parser. To exploit this, the attacker must successfully authenticate via a username and password or through source IP address matching.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update Certified Asterisk to version 20.7-cert11 Update Certified Asterisk to version 22.8-cert3