DEBIAN-CVE-2026-57199: Low severity debian/asterisk vulnerability

Q: Which deployments are realistically exposed?

Exposure requires an administrator to have explicitly configured the SMS dialplan application. The application is used when routing calls to or from analog devices, so deployments that do not use this application are not described as affected.

Q: What does an attacker need to exploit the issue?

An attacker needs to provide externally controlled SMS length data that reaches the SMS dialplan application without adequate validation. Exploitation can corrupt Asterisk memory or crash the service.

Q: Are default configurations affected?

The issue requires explicit use of the SMS dialplan application, so it is not described as affecting configurations that have not enabled and configured that application.

Q: What can be done before updating?

Disable or avoid use of the SMS dialplan application where possible. If it must remain enabled, ensure data passed to the application is valid.

Q: Which releases contain the fix?

Fixed releases are Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, appsms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the SMS dialplan application, which is useful when routing calls to or from analog devices, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·10:17 PM

Data Sourced

via OSV·10:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Exposure requires an administrator to have explicitly configured the SMS dialplan application. The application is used when routing calls to or from analog devices, so deployments that do not use this application are not described as affected.

What does an attacker need to exploit the issue?

An attacker needs to provide externally controlled SMS length data that reaches the SMS dialplan application without adequate validation. Exploitation can corrupt Asterisk memory or crash the service.

Are default configurations affected?

The issue requires explicit use of the SMS dialplan application, so it is not described as affecting configurations that have not enabled and configured that application.

What can be done before updating?

Disable or avoid use of the SMS dialplan application where possible. If it must remain enabled, ensure data passed to the application is valid.

Which releases contain the fix?

Fixed releases are Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, plus Certified Asterisk 20.7-cert11 and 22.8-cert3.

DEBIAN-CVE-2026-57199: Low severity debian/asterisk vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit the issue?

Are default configurations affected?

What can be done before updating?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to exploit the issue?

Are default configurations affected?

What can be done before updating?

Which releases contain the fix?