CVE-2026-57195: Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP. The Asterisk HTTP web server, AMI, and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
A deployment is exposed only if the Asterisk HTTP web server, AMI, and AMI access over HTTP are all enabled, and Digest Authentication is used through HTTP. These components are disabled by default, and the HTTP server binds to 127.0.0.1 by default even when enabled.
What access does an attacker need to trigger the crash?
The attacker does not need authentication, but must be able to connect to the Asterisk HTTP server. Remote exposure depends on whether the HTTP listener has been configured to accept connections beyond its default loopback binding.
What can be done while waiting to patch?
Disable AMI access via HTTP, the AMI service, or the Asterisk HTTP web server if those functions are not required. Restrict connectivity to the HTTP listener so untrusted clients cannot reach it.
Which releases contain the fix?
The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.