Login Request a demo
AS
Product
Asterisk
by Sangoma · last CVE Feb 6, 2026
28
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities28In the news0Timeline
Severity mix
Critical 4High 8Medium 13Low 0
Severity
All severities28Critical4High8Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Asterisk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-57520
9.8
1%
Feb 5
Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function
Affected: 22.0.0 through 22.5.1
CVE-2022-23608
9.8
4%
Feb 22
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: 16.0.0 before 16.24.1; 18.0.0 before 18.10.1; 19.0.0 before 19.2.1
CVE-2021-37706
9.8
5%
Dec 22
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: 16.0.0 before 16.24.1; 18.0.0 before 18.10.1; 19.0.0 before 19.2.1
CVE-2022-21723
9.1
4%
Jan 27
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE
Affected: 16.0.0 before 16.24.1; 18.0.0 before 18.10.1; 19.0.0 before 19.2.1
CVE-2026-23741
8.8
0%
Feb 6
ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
Affected: before 20.18.2; 21.0.0 before 21.12.1; 22.0.0 before 22.8.2; 23.0.0 before 23.2.2
CVE-2026-23740
7.8
0%
Feb 6
Asterisk vulnerable to potential privilege escalation
Affected: before 20.18.2; 21.0.0 before 21.12.1; 22.0.0 before 22.8.2; 23.0.0 before 23.2.2
CVE-2025-1131
7.8
0%
Sep 23
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Affected: before 18.26.3; 20.0.0 before 20.15.1; 21.0.0 before 21.10.1; 22.0.0 before 22.5.1
CVE-2025-47780
7.8
0%
May 22
Asterisk is an open-source private branch exchange (PBX)
Affected: before 18.26.2; 20.0.0 before 20.14.1; 21.0.0 before 21.9.1; 22.0.0 before 22.4.1
CVE-2025-57767
7.5
0%
Aug 28
Asterisk is an open source private branch exchange and telephony toolkit
Affected: before 20.15.2; 21.0.0 before 21.10.2; 22.0.0 before 22.5.2
CVE-2022-37325
7.5
1%
Dec 5
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or…
Affected: 16.0.0 before 16.29.1; 18.0.0 before 18.15.1; 19.0.0 before 19.7.1; 20.0.0
CVE-2009-3723
7.5
1%
Oct 29
asterisk allows calls on prohibited networks
Affected: 1.6.1 before 1.6.1.8
CVE-2017-9358
7.5
3%
Jun 2
A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered…
Affected: 13.0.0; 13.1.0; 13.1.0; 13.1.0; 13.2.0; 13.2.0; +34 more
CVE-2026-23739
6.5
0%
Feb 6
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
Affected: before 20.18.2; 21.0.0 before 21.12.1; 22.0.0 before 22.8.2; 23.0.0 before 23.2.2
CVE-2025-54995
6.5
0%
Aug 28
Asterisk is an open source private branch exchange and telephony toolkit
Affected: before 18.26.4
CVE-2025-49832
6.5
0%
Aug 1
Asterisk is an open source private branch exchange and telephony toolkit
Affected: before 18.26.3; 20.0.0 before 20.15.1; 21.0.0 before 21.10.1; 22.0.0 before 22.5.1
CVE-2025-47779
6.5
1%
May 22
Asterisk is an open-source private branch exchange (PBX)
Affected: before 18.26.2; 20.0.0 before 20.14.1; 21.0.0 before 21.9.1; 22.0.0 before 22.4.1
CVE-2022-42705
6.5
1%
Dec 5
A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of…
Affected: 16.0.0 before 16.29.1; 18.14.0 before 18.15.1; 19.6.0 before 19.7.1; 20.0.0
CVE-2020-28242
6.5
2%
Nov 6
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5
Affected: 13.0 before 13.37.1; 16.0 before 16.14.1; 17.0 before 17.8.1; 18.0 before 18.0.1
CVE-2018-12228
6.5
6%
Jun 12
An issue was discovered in Asterisk Open Source 15.x before 15.4.1
Affected: 15.0 before 15.4.1
CVE-2026-23738
6.1
0%
Feb 6
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Affected: through 20.18.2; 21.0.0 through 21.12.1; 22.0.0 through 22.8.2; 23.0.0 before 23.2.2
CVE-2024-42491
5.7
1%
Sep 5
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
Affected: before 18.24.3; 20.0.0 before 20.9.3; 21.0.0 through 21.4.3
CVE-2024-53566
5.5
0%
Dec 2
An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal
Affected: 22.0.0; 22.0.0; 22.0.0; 22.0.0
CVE-2024-35190
5.3
1%
May 17
Asterisk is an open source private branch exchange and telephony toolkit
Affected: 18.23.0; 20.8.0; 21.3.0
CVE-2020-28327
5.3
2%
Nov 6
A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1
Affected: 13.0.0 before 13.37.1; 16.0.0 before 16.14.1; 17.0.0 before 17.8.1; 18.0.0 before 18.0.1
CVE-2022-42706
4.9
1%
Dec 5
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1
Affected: 16.0.0 before 16.29.1; 17.0.0 before 18.15.1; 19.0.0 before 19.7.1; 20.0.0
CVE-2012-2186
–
4%
Aug 31
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk…
Affected: through 1.8.15.0; through 10.7.0
CVE-2012-2948
–
2%
Jun 2
chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1…
Affected: through 1.8.12.0; through 10.4.0
CVE-2009-2346
–
3%
Sep 8
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x…
Affected: 1.6.1; 1.6.1.4
Showing 28