NULL Pointer Dereference Vulnerability in Asterisk Manager Interface
CVE-2026-57195
7.5HIGH
What is CVE-2026-57195?
A vulnerability in the Asterisk Manager Interface (AMI) can result in a NULL pointer dereference, enabling an unauthorized attacker to crash the Asterisk system when using Digest Authentication via HTTP. Although AMI, the Asterisk HTTP web server, and HTTP access are typically disabled by default, if they are enabled, the attacker only needs access to the HTTP server, which binds to localhost (127.0.0.1), to exploit the flaw. This issue has been resolved in recent versions of Asterisk, urging users to update their systems promptly.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1