DEBIAN-CVE-2026-57188: Buffer Overflow

Q: Which deployments are exposed to exploitation?

Exposure requires the res_xmpp module to be loaded and an XMPP connection to be configured in xmpp.conf. The attacker must also have an XMPP account on the same server or on a federated server.

Q: Does an unauthenticated network attacker need access to exploit this issue?

No. The issue requires an authenticated attacker with an XMPP account on the same or a federated XMPP server, but no user interaction is required.

Q: What can be done if an update cannot be applied immediately?

Remove the conditions required for exploitation by unloading res_xmpp or disabling the configured XMPP connection in xmpp.conf. Restricting attacker access to accounts on the local or federated XMPP server also reduces exposure.

Q: How can I determine whether my instance needs remediation?

Check whether res_xmpp is loaded, whether xmpp.conf contains an XMPP connection configuration, and whether users can obtain accounts on the same or federated XMPP server. Update affected installations to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in resxmpp XMPP namespace prefix handling using carefully crafted packets. The resxmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk 20.x to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk 21.x to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk 22.x to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk 23.x to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk 20.x to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk 22.x to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to exploitation?

Exposure requires the res_xmpp module to be loaded and an XMPP connection to be configured in xmpp.conf. The attacker must also have an XMPP account on the same server or on a federated server.

Does an unauthenticated network attacker need access to exploit this issue?

No. The issue requires an authenticated attacker with an XMPP account on the same or a federated XMPP server, but no user interaction is required.

What can be done if an update cannot be applied immediately?

Remove the conditions required for exploitation by unloading res_xmpp or disabling the configured XMPP connection in xmpp.conf. Restricting attacker access to accounts on the local or federated XMPP server also reduces exposure.

How can I determine whether my instance needs remediation?

Check whether res_xmpp is loaded, whether xmpp.conf contains an XMPP connection configuration, and whether users can obtain accounts on the same or federated XMPP server. Update affected installations to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3.

DEBIAN-CVE-2026-57188: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to exploitation?

Does an unauthenticated network attacker need access to exploit this issue?

What can be done if an update cannot be applied immediately?

How can I determine whether my instance needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to exploitation?

Does an unauthenticated network attacker need access to exploit this issue?

What can be done if an update cannot be applied immediately?

How can I determine whether my instance needs remediation?