XML Parsing Vulnerability in Asterisk Telephony Toolkit

CVE-2026-23739

What is CVE-2026-23739?

The Asterisk Telephony Toolkit is affected by an XML parsing vulnerability that can lead to XML External Entity (XXE) attacks. This occurs due to the ast_xml_open() function in xml.c which incorrectly parses XML documents using libxml with unsafe options. When an attacker supplies a malicious XML file, it can enable local file disclosure on the host system. The vulnerability has been addressed in several patched versions, ensuring better security against entity expansion and XInclude processing.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References