Product by Sangoma
Asterisk
31 known vulnerabilities in Asterisk (Sangoma), 0 of them actively exploited (CISA KEV).
Key figures
31
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-21723 | Out-of-bounds read in multipart parsing in PJSIP | 9.1 | |
| High | CVE-2023-49786 | Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| High | CVE-2023-49294 | Asterisk Path Traversal vulnerability | 4.9 | |
| Critical | CVE-2022-23608 | Use after free in PJSIP | 8.1 | |
| Critical | CVE-2021-37706 | Potential integer underflow upon receiving STUN message in PJSIP | 7.3 | |
| Medium | CVE-2018-12228 | Sangoma Asterisk: Infinite Loop | 6.5 | |
| High | CVE-2017-9358 | Sangoma Asterisk: Infinite Loop | 7.5 | |
| Critical | CVE-2024-57520 | Sangoma Asterisk: Path Traversal | 9.8 | |
| Medium | CVE-2020-28327 | Digium Certified Asterisk: security vulnerability | 5.3 | |
| High | CVE-2022-37325 | Sangoma Asterisk: security vulnerability | 7.5 | |
| Medium | CVE-2020-28242 | Sangoma Asterisk: security vulnerability | 6.5 | |
| High | CVE-2023-37457 | Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' | 7.5 | |
| High | CVE-2009-3723 | Asterisk: security vulnerability | 7.5 | |
| Medium | CVE-2022-42705 | Sangoma Asterisk: Use-After-Free | 6.5 | |
| Not rated | CVE-2012-2186 | Asterisk Open Source: security vulnerability | — | |
| High | CVE-2025-47779 | Using malformed From header can forge identity with ";" or NULL in name portion | 7.7 | |
| Medium | CVE-2022-42706 | Sangoma Asterisk: Path Traversal | 4.9 | |
| High | CVE-2025-57767 | Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request | 7.5 | |
| Medium | CVE-2025-54995 | Asterisk remotely exploitable leak of RTP UDP ports and internal resources | 6.5 | |
| Not rated | CVE-2009-2346 | Asterisk Open Source: Denial of Service | — | |
| Medium | CVE-2025-49832 | Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation | 6.5 | |
| Not rated | CVE-2012-2948 | Asterisk Open Source: NULL Pointer Dereference | — | |
| Medium | CVE-2024-42491 | Asterisk: Unchecked Return Value | 5.7 | |
| Medium | CVE-2024-35190 | Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests | 5.8 | |
| High | CVE-2025-47780 | cli_permissions.conf: deny option does not work for disallowing shell commands | 7.8 |