CVE-2026-57195

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 20.7-cert11 Certified Asterisk versions prior to 22.8-cert3

Description A NULL pointer dereference in the Asterisk Manager Interface (AMI) allows an unauthenticated attacker to crash the system when Digest Authentication is used via HTTP. This requires the Asterisk HTTP web server, AMI, and AMI access via HTTP to be enabled. By default, these components are disabled, and the HTTP server binds only to 127.0.0.1.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update to Certified Asterisk version 20.7-cert11 Update to Certified Asterisk version 22.8-cert3 As a temporary mitigation, disable the Asterisk HTTP web server, AMI, or AMI access via HTTP.