CVE-2026-57187
Received Received - Intake

Heap Use After Free in Asterisk SIP INVITE Handling

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-57187
EUVD
EUVD-2026-110076

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
asterisk asterisk < 20.20.1
asterisk asterisk >= 21.0.0-pre1, < 21.12.3
asterisk asterisk >= 22.0.0-pre1, < 22.10.1
asterisk asterisk >= 23.0.0-pre1, < 23.4.1
asterisk certified-asterisk < 20.7-cert11
asterisk certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57187 is a use-after-free vulnerability in Asterisk's PJSIP module. It occurs in the filter_on_tx_message() function where pj_strassign() was used to copy a pointer to a transport's local address instead of duplicating the actual string value. If a connection-oriented transport disconnects before Asterisk sends a 200 OK response, the pointers become invalid, leading to potential memory corruption when accessed later.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in Asterisk when processing SIP INVITE messages over connection-oriented transports. Since the issue is only reproducible with Address Sanitizer, enable it during compilation and run Asterisk in a test environment. Monitor logs for heap-use-after-free errors or crashes during SIP session handling.

Impact Analysis

An authenticated attacker could exploit this to cause a crash in Asterisk by sending a SIP INVITE and disconnecting before the 200 OK response. While currently only reproducible with Address Sanitizer, successful exploitation could lead to system unavailability or potential remote code execution in affected systems.

Mitigation Strategies

Upgrade Asterisk to a patched version: 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11, 22.8-cert3. If immediate upgrade is not possible, restrict access to Asterisk management interfaces and monitor SIP traffic for suspicious INVITE patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart