DEBIAN-CVE-2026-57195: Null Pointer Dereference

Q: Are default Asterisk deployments exposed?

No. The Asterisk HTTP web server, AMI, and AMI access through HTTP are each disabled by default. In addition, the HTTP server binds to 127.0.0.1 by default even when enabled.

Q: What does an attacker need to exploit this issue?

The attacker must be able to connect to the Asterisk HTTP server. Exploitation also requires Digest Authentication to be used through HTTP with the HTTP server, AMI, and AMI-over-HTTP enabled; no authentication is required for the crash attempt.

Q: What can be done if an update cannot be applied immediately?

Disable the Asterisk HTTP server, AMI, or AMI access through HTTP if those services are not needed. Restricting access to the HTTP listener so untrusted parties cannot connect also reduces exposure.

Q: Which releases contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP. The Asterisk HTTP web server, AMI, and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·09:18 PM

Data Sourced

via OSV·09:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are default Asterisk deployments exposed?

No. The Asterisk HTTP web server, AMI, and AMI access through HTTP are each disabled by default. In addition, the HTTP server binds to 127.0.0.1 by default even when enabled.

What does an attacker need to exploit this issue?

The attacker must be able to connect to the Asterisk HTTP server. Exploitation also requires Digest Authentication to be used through HTTP with the HTTP server, AMI, and AMI-over-HTTP enabled; no authentication is required for the crash attempt.

What can be done if an update cannot be applied immediately?

Disable the Asterisk HTTP server, AMI, or AMI access through HTTP if those services are not needed. Restricting access to the HTTP listener so untrusted parties cannot connect also reduces exposure.

Which releases contain fixes?

Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.

DEBIAN-CVE-2026-57195: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default Asterisk deployments exposed?

What does an attacker need to exploit this issue?

What can be done if an update cannot be applied immediately?

Which releases contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Are default Asterisk deployments exposed?

What does an attacker need to exploit this issue?

What can be done if an update cannot be applied immediately?

Which releases contain fixes?