Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
Impact
Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, and 23.4.1 have a heap-use-after-free weakness in PJSIP TCP/SDP handling. An authenticated attacker may cause this issue by sending a SIP INVITE and disconnecting before Asterisk responds. The impact has only been observed with Address Sanitizer enabled.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
asterisk · GitHub_M
asterisk
4 ranges
asterisk · GitHub_M
asterisk
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 20.20.1
>= 21.0.0-pre1, < 21.12.3
>= 22.0.0-pre1, < 22.10.1
>= 23.0.0-pre1, < 23.4.1
Other versions: unknown
asterisk · GitHub_M
certified-asterisk
2 ranges
asterisk · GitHub_M
certified-asterisk
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 20.7-cert11
>= 22.8-cert1-pre1, < 22.8-cert3
Other versions: unknown
Original source description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with the 200 OK. So far, the crash has only been reproduced when Asterisk is built with Address Sanitizer, which detects the issue. Address Sanitizer is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-57187View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.