CVE-2026-57193: Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

Q: Which deployments are exposed to this issue?

Only Asterisk deployments with the res_config_ldap module loaded and configured to access an LDAP server are affected. This LDAP realtime configuration is not enabled by default.

Q: Does exploitation require SIP authentication?

No. An unauthenticated attacker can send carefully crafted SIP packets containing a malicious SIP username to trigger LDAP filter injection.

Q: What is the impact of a successful attack?

An attacker can cause arbitrary LDAP queries to be made and disclose information returned through those queries.

Q: What versions contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 26, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver resconfigldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The resconfigldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

2 affected components

Asterisk Asterisk<20.20.1, <21.12.3, <22.10.1, <23.4.1

Asterisk Certified Asterisk<20.7-cert11, <22.8-cert3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk 20.x to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk 21.x to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk 22.x to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk 23.x to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk 20.x to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk 22.x to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 26, 2026

CVE Published

via MITRE·07:46 PM

Data Sourced

via MITRE·07:46 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only Asterisk deployments with the res_config_ldap module loaded and configured to access an LDAP server are affected. This LDAP realtime configuration is not enabled by default.

Does exploitation require SIP authentication?

No. An unauthenticated attacker can send carefully crafted SIP packets containing a malicious SIP username to trigger LDAP filter injection.

What is the impact of a successful attack?

An attacker can cause arbitrary LDAP queries to be made and disclose information returned through those queries.

What versions contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

CVE-2026-57193: Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require SIP authentication?

What is the impact of a successful attack?

What versions contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require SIP authentication?

What is the impact of a successful attack?

What versions contain fixes?