CVE-2026-23739
XML External Entity (XXE) Vulnerability in Asterisk XML Parsing
Publication date: 2026-02-06
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | to 18.9 (inc) |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
| sangoma | asterisk | to 20.18.2 (exc) |
| sangoma | asterisk | From 21.0.0 (inc) to 21.12.1 (exc) |
| sangoma | asterisk | From 22.0.0 (inc) to 22.8.2 (exc) |
| sangoma | asterisk | From 23.0.0 (inc) to 23.2.2 (exc) |
| sangoma | certified_asterisk | 20.7 |
| sangoma | certified_asterisk | 20.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23739 is a vulnerability in the Asterisk telephony software caused by unsafe XML parsing in the ast_xml_open() function. This function uses the libxml2 library with insecure options that enable XML External Entity (XXE) injection and XInclude processing. Specifically, it calls xmlReadFile() with the XML_PARSE_NOENT flag, which allows external entities to be expanded, and then processes XIncludes. If an attacker can supply or influence XML input to this function, they can exploit this to disclose local files or other sensitive information from the host system.
Although Asterisk does not currently allow untrusted or user-supplied XML input, this vulnerability poses a risk if that policy changes or if other attack vectors allow malicious XML input to be processed. The issue arises because the XML_PARSE_NOENT option enables external entity resolution, which is disabled by default in newer libxml2 versions due to security concerns.
How can this vulnerability impact me? :
This vulnerability can allow an attacker who can supply or influence XML input to the vulnerable Asterisk function to trigger XML External Entity (XXE) or XInclude-based local file disclosure. This means the attacker could potentially access sensitive files on the host system that should not be exposed.
The impact is considered low severity with a CVSS v3.1 base score of 2.0. Exploitation requires high privileges, user interaction, and has a high attack complexity. The confidentiality impact is rated as none, integrity impact as low, and availability impact as none.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from unsafe XML parsing in the ast_xml_open() function of Asterisk, specifically when processing XML files with the XML_PARSE_NOENT flag and XInclude processing enabled. Detection involves identifying if your Asterisk installation is running a vulnerable version (≤ 23.2.1, ≤ 22.8.1, ≤ 21.12.0, ≤ 20.18.1, ≤ 20.7-cert8) and if it processes untrusted or user-supplied XML input.
To detect the vulnerability on your system, you can check the installed Asterisk version with the command:
- asterisk -V
If the version is vulnerable, you can also search for XML files or logs that might indicate processing of external entities or XIncludes. Since the vulnerability requires user-supplied XML input, monitoring for unusual XML input or suspicious network traffic involving XML payloads could help.
There are no specific commands provided in the resources for direct detection of exploitation attempts, but general network monitoring tools like tcpdump or Wireshark can be used to capture and analyze XML traffic to the Asterisk server.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Asterisk to a patched version that addresses this vulnerability. The fixed versions are 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
If upgrading immediately is not possible, ensure that untrusted or user-supplied XML input is not processed by the Asterisk system, as the vulnerability requires such input to be exploitable.
Additionally, review and restrict access to the Asterisk system to trusted users only, and monitor for any unusual XML processing activity.