Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
Impact
Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3, may permit LDAP filter injection via a SIP username, allowing an unauthenticated attacker to disclose information. The res_config_ldap module must be loaded and configured. This issue affects Asterisk and Certified Asterisk.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
asterisk · GitHub_M
asterisk
4 ranges
asterisk · GitHub_M
asterisk
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 20.20.1
>= 21.0.0-pre1, < 21.12.3
>= 22.0.0-pre1, < 22.10.1
>= 23.0.0-pre1, < 23.4.1
Other versions: unknown
asterisk · GitHub_M
certified-asterisk
2 ranges
asterisk · GitHub_M
certified-asterisk
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 20.7-cert11
>= 22.8-cert1-pre1, < 22.8-cert3
Other versions: unknown
Original source description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-57193View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-57193
Observed 2026-10-31T01:57:39.820Z · upstream updated 2026-10-31T01:46:55.030Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-31T01:46:45.323083Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.