Heap Use After Free Vulnerability in Asterisk Telephony Toolkit
CVE-2026-57187
What is CVE-2026-57187?
The Asterisk telephony toolkit has a vulnerability that allows an authenticated attacker to trigger a heap-use-after-free condition through a specific sequence of SIP INVITE requests sent over a connection-oriented transport. The issue arises when the attacker disconnects before Asterisk responds with a 200 OK message. While this flaw has been reliably reproduced under specific conditions using Address Sanitizer, it is important to note that this development tool is typically not present in production environments. The vulnerability has been addressed in later versions of Asterisk, ensuring users can maintain secure telephony solutions.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1