AS
Product
asterisk
41
CVEs
0
On KEV
8.8
Max CVSS
20
New 30D
Severity mix
Critical 0High 11Medium 7Low 4
Watch
Add asterisk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-42365 | 8.8 | Aug 8 | Asterisk is an open source private branch exchange (PBX) and telephony toolkit Affected: before 18.24.2; 19.0.0 before 20.9.1; 21.4.0 |
| CVE-2026-57191 New | 8.2 | Oct 27 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57202 New | 8.1 | Oct 27 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57197 New | 7.7 | Oct 27 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57186 New | 7.5 | Oct 27 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser Affected: >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57200 New | 7.5 | Oct 27 | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57195 New | 7.5 | Oct 27 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57201 New | 7.5 | Oct 27 | Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57188 New | 7.1 | Oct 27 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57187 New | 7.1 | Oct 26 | Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
| CVE-2026-57190 New | 7.0 | Oct 27 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field Affected: < 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 |
Showing 11