Vendor
Asterisk
88 known vulnerabilities in products by Asterisk, 0 of them actively exploited (CISA KEV).
Key figures
88
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-57193 | Asterisk: Improper Neutralization of Special Elements in Data Query Logic | — | |
| Critical | CVE-2022-21723 | Out-of-bounds read in multipart parsing in PJSIP | 9.1 | |
| High | CVE-2024-42365 | Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan | 7.4 | |
| High | CVE-2023-49786 | Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| High | CVE-2023-49294 | Asterisk Path Traversal vulnerability | 4.9 | |
| Critical | CVE-2022-23608 | Use after free in PJSIP | 8.1 | |
| Critical | CVE-2021-37706 | Potential integer underflow upon receiving STUN message in PJSIP | 7.3 | |
| Medium | CVE-2021-46837 | Asterisk Certified Asterisk: security vulnerability | 6.5 | |
| High | CVE-2017-9358 | Sangoma Asterisk: Infinite Loop | 7.5 | |
| High | CVE-2026-57200 | Asterisk: Path Traversal | 7.5 | |
| High | CVE-2026-57201 | Asterisk: Out-of-bounds Write | 7.5 | |
| High | CVE-2026-57191 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing | — | |
| High | CVE-2026-57190 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field | — | |
| High | CVE-2026-57186 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser | 7.5 | |
| High | CVE-2026-57195 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication | 7.5 | |
| High | CVE-2026-57197 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) | — | |
| High | CVE-2026-57202 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes | 8.1 | |
| High | CVE-2026-57188 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling | — | |
| Medium | CVE-2026-57192 | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch | — | |
| High | CVE-2026-57187 | Asterisk: Use After Free | — | |
| Medium | CVE-2026-57184 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) | — | |
| Not rated | CVE-2007-3764 | Asterisk: Denial of Service | — | |
| Not rated | CVE-2008-3263 | Asterisk: Denial of Service | — | |
| Medium | CVE-2020-28242 | Sangoma Asterisk: security vulnerability | 6.5 | |
| Not rated | CVE-2007-3763 | Asterisk: NULL Pointer Dereference | — |
Products
| Asterisk | 56 | 0 |
| Certified-asterisk | 30 | 0 |
| Open Source | 22 | 0 |
| Asterisk Appliance Developer Kit | 13 | 0 |
| Asterisknow | 13 | 0 |
| Asterisk Business Edition | 11 | 0 |
| S800i | 7 | 0 |
| S800i Appliance | 5 | 0 |
| Digiumphones | 3 | 0 |
| Zaptel | 3 | 0 |