Product by Asterisk
Certified-asterisk
44 known vulnerabilities in Certified-asterisk (Asterisk), 0 of them actively exploited (CISA KEV).
Key figures
44
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2026-57193 | Asterisk: Improper Neutralization of Special Elements in Data Query Logic | — | |
| Critical | CVE-2022-21723 | Out-of-bounds read in multipart parsing in PJSIP | 9.1 | |
| High | CVE-2024-42365 | Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan | 7.4 | |
| High | CVE-2023-49786 | Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| High | CVE-2023-49294 | Asterisk Path Traversal vulnerability | 4.9 | |
| Critical | CVE-2022-23608 | Use after free in PJSIP | 8.1 | |
| Critical | CVE-2021-37706 | Potential integer underflow upon receiving STUN message in PJSIP | 7.3 | |
| Medium | CVE-2021-46837 | Asterisk Certified Asterisk: security vulnerability | 6.5 | |
| High | CVE-2017-9358 | Sangoma Asterisk: Infinite Loop | 7.5 | |
| High | CVE-2026-57187 | Asterisk: Use After Free | — | |
| Medium | CVE-2026-57184 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) | — | |
| Medium | CVE-2020-28242 | Sangoma Asterisk: security vulnerability | 6.5 | |
| High | CVE-2023-37457 | Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' | 7.5 | |
| High | CVE-2026-57191 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing | — | |
| High | CVE-2026-57202 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes | 8.1 | |
| High | CVE-2026-57197 | Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex) | — | |
| High | CVE-2026-57186 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser | 7.5 | |
| High | CVE-2026-57200 | Asterisk: Path Traversal | 7.5 | |
| High | CVE-2026-57195 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication | 7.5 | |
| High | CVE-2026-57201 | Asterisk: Out-of-bounds Write | 7.5 | |
| Low | CVE-2026-57196 | Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages | — | |
| High | CVE-2026-57188 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling | — | |
| High | CVE-2026-57190 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field | — | |
| Medium | CVE-2026-57203 | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location | — | |
| Not rated | CVE-2012-2186 | Asterisk Open Source: security vulnerability | — |