CVE-2026-57193
Received Received - Intake

LDAP Filter Injection in Asterisk

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-57193
EUVD
EUVD-2026-110081

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
asterisk asterisk < 20.20.1
asterisk asterisk >= 21.0.0-pre1, < 21.12.3
asterisk asterisk >= 22.0.0-pre1, < 22.10.1
asterisk asterisk >= 23.0.0-pre1, < 23.4.1
asterisk certified-asterisk < 20.7-cert11
asterisk certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57193 is an LDAP filter injection vulnerability in Asterisk's LDAP realtime driver (res_config_ldap). It allows unauthenticated attackers to inject special LDAP filter characters like *, (, ), and \ via the SIP username in From headers. This can manipulate LDAP queries to disclose sensitive information when the module is loaded and configured to access an LDAP server.

Detection Guidance

Check if the res_config_ldap module is loaded and configured in Asterisk by running: asterisk -rx 'module show like res_config_ldap'. If loaded, monitor SIP traffic for unusual LDAP filter patterns or malformed usernames containing special characters like *, (, ), or \.

Impact Analysis

An attacker could exploit this to perform unauthorized LDAP queries, potentially accessing sensitive directory information like user credentials or contact details. The attack requires network access and the LDAP module to be enabled, which is not default. Impact is primarily on confidentiality with no direct effect on system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal data stored in LDAP directories, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected Asterisk versions with LDAP integration may face compliance violations if exploited.

Mitigation Strategies

Upgrade Asterisk to patched versions: 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11, 22.8-cert3. If LDAP is not required, disable the res_config_ldap module using: asterisk -rx 'module unload res_config_ldap'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart