Login Request a demo
CE
Product
certified-asterisk
by asterisk · last CVE Oct 27, 2026
30
CVEs
0
On KEV
9.8
Max CVSS
19
New 30D
Vulnerabilities30In the news0Timeline
Severity mix
Critical 3High 11Medium 8Low 4
Severity
All severities30Critical3High11Medium8Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add certified-asterisk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-23608
9.8
4%
Feb 22
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: before 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; +7 more
CVE-2021-37706
9.8
5%
Dec 22
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: before 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; +8 more
CVE-2022-21723
9.1
4%
Jan 27
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; +7 more
CVE-2024-42365
8.8
5%
Aug 8
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +34 more
CVE-2026-57191
New
8.2–Oct 27
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57202
New
8.1–Oct 27
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57197
New
7.7–Oct 27
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57186
New
7.5–Oct 27
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Affected: >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57195
New
7.5–Oct 27
Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57201
New
7.5–Oct 27
Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2017-9358
7.5
3%
Jun 2
A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered…
Affected: 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; +4 more
CVE-2026-57188
New
7.1–Oct 27
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57187
New
7.1
0%
Oct 26
Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57190
New
7.0–Oct 27
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57203
New
6.9–Oct 27
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57193
New
6.9
2%
Oct 26
Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57185
New
6.5–Oct 27
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2021-46837
6.5
5%
Aug 30
res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash…
Affected: 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; 16.8.0; +1 more
CVE-2020-28242
6.5
2%
Nov 6
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5
Affected: through 16.8.0
CVE-2026-57184
New
6.3
1%
Oct 26
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57192
New
6.0–Oct 27
Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57194
New
5.9–Oct 27
Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57199
New
2.3–Oct 27
Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57189
New
2.3–Oct 27
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57198
New
2.3–Oct 27
Asterisk: Possible RED T.140 Heap Buffer Overflow
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2026-57196
New
2.3
1%
Oct 26
Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
Affected: < 20.7-cert11; >= 22.8-cert1-pre1, < 22.8-cert3
CVE-2013-2686
–
2%
Apr 1
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and…
Affected: 1.8.15; 1.8.15; 1.8.15; 1.8.15; 1.8.15.0; 1.8.15.0
CVE-2013-2264
–
1%
Apr 1
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business…
Affected: 1.8.15; 1.8.15; 1.8.15; 1.8.15; 1.8.15.0; 1.8.15.0
CVE-2012-2186
–
4%
Aug 31
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk…
Affected: through 1.8.11; 1.8.11; 1.8.11; 1.8.11; 1.8.11; 1.8.11
CVE-2012-2948
–
2%
Jun 2
chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1…
Affected: 1.8.11; 1.8.11
Showing 30