CVE-2026-23738: The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using aststrappend. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23738?
CVE-2026-23738 is considered to be of high severity due to the potential for cross-site scripting attacks.
How do I fix CVE-2026-23738?
To fix CVE-2026-23738, you should update Asterisk to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2 or later.
What is affected by CVE-2026-23738?
CVE-2026-23738 affects versions of Asterisk prior to 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
What types of attacks can CVE-2026-23738 enable?
CVE-2026-23738 can enable cross-site scripting (XSS) attacks due to the lack of sanitization of user input.
How can I verify if my Asterisk installation is vulnerable to CVE-2026-23738?
You can verify if your Asterisk installation is vulnerable to CVE-2026-23738 by checking if it is running a version lower than the patched versions mentioned.