EUVD-2026-111393Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Asterisk HTTP AMI endpoint
-
ExploitSend crafted Digest Authentication HTTP request
-
ExecutionTrigger NULL pointer dereference in auth_http_callback
-
ImpactCrash Asterisk process, telephony outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a specific non-default configuration: the Asterisk HTTP web server must be enabled (disabled by default), the Asterisk Manager Interface must be enabled (disabled by default), and AMI access via HTTP must be enabled (disabled by default), with Digest Authentication used over HTTP. The attacker must additionally be able to reach the HTTP listener, which binds only to 127.0.0.1 by default even when enabled - so remote exploitation further requires the operator to have rebound the listener to a routable interface (or an attacker with local/loopback access). The limiting factors are therefore these four stacked opt-in settings plus the default loopback binding; where all are met, no credentials or user interaction are needed (PR:N, UI:N). |
| Impact | This is a textbook case of a high CVSS base score that overstates real-world risk because of deployment preconditions the base metric cannot capture. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) correctly reflects an unauthenticated, network-reachable availability-only impact (NULL pointer dereference crash, CWE-476), and PR:N is consistent with the description's 'unauthenticated attacker.' However, the GHSA advisory and NVD description both state four stacking preconditions, each disabled by default: the Asterisk HTTP server, AMI, and AMI-over-HTTP must all be explicitly enabled, and even when the HTTP server is enabled it binds only to 127.0.0.1 by default - so an off-host network attacker cannot reach it unless the operator has additionally rebound it to a routable interface. No EPSS score is supplied, so exploitation probability cannot be quantified from the input. There is no CISA KEV listing and no verified public exploit code (the references are the vendor advisory and the fix commits, not a PoC). The vuln.today decision label is 'this_week' rather than act_now/emergency. Net assessment: a genuine unauthenticated remote DoS on paper, but the compounded non-default configuration and default localhost binding make widespread opportunistic exploitation unlikely; prioritize patching only where AMI-over-HTTP is enabled and the HTTP listener is exposed beyond loopback. |
| Exploit ScenarioDerived | An attacker able to reach an Asterisk HTTP listener that has been rebound off loopback and has AMI-over-HTTP enabled sends a crafted Digest Authentication request to the AMI endpoint, triggering a NULL pointer dereference in auth_http_callback that crashes the Asterisk process and interrupts telephony service. Because CVSS is AV:N/AC:L/PR:N, no authentication or user interaction is required once the attacker can connect, but no verified public exploit code was identified at time of analysis. The realistic exposure window is limited to deployments that have enabled the HTTP server, AMI, and AMI-via-HTTP and moved the bind address away from the default 127.0.0.1. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A NULL pointer dereference in Asterisk's Asterisk Manager Interface (AMI) handling of Digest Authentication over HTTP lets an unauthenticated remote attacker crash the telephony server (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/A:H) by triggering a logging path in main/manager.c that dereferences a NULL address. Only deployments that have opted into all three non-default features are exposed - the HTTP web server, AMI itself, and AMI access via HTTP - and the HTTP listener binds to 127.0.0.1 by default even when enabled, so practical reachability requires the operator to have rebound it to a routable interface. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the deployment preconditions mean the base score overstates real-world exposure; fixed releases exist in every maintained branch and the vendor decision is to remediate this week.
RemediationAI
Vendor-released patch: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1 or 23.4.1, or to Certified Asterisk 20.7-cert11 or 22.8-cert3 - release artifacts are at https://github.com/asterisk/asterisk/releases/tag/20.20.1, https://github.com/asterisk/asterisk/releases/tag/21.12.3, https://github.com/asterisk/asterisk/releases/tag/22.10.1, https://github.com/asterisk/asterisk/releases/tag/23.4.1, https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 and https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3, and the upstream fixes are the commits referenced in GHSA-3rhj-hhw7-m6fw (notably 10c5b2efcacab03bf04a229f81cc24e76fe42c41 in main/manager.c). Where upgrading must be staged, the exposure can be removed by breaking any one of the four required conditions the vendor lists: leave the Asterisk HTTP web server disabled (disabled by default), leave the Asterisk Manager Interface disabled (disabled by default), leave AMI access via HTTP disabled (disabled by default), or keep the HTTP listener bound to its default 127.0.0.1 so untrusted networks cannot reach it - the trade-off in each case is loss of HTTP-based AMI/provisioning access or of remote AMI-over-HTTP management, which must be replaced by other management channels such as AMI over TCP or the CLI. Deployments that need AMI over HTTP should treat patch application as this week's work per the vendor priority, since the credentials-free crash is trivial to trigger once the configuration preconditions are met.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-476 (NULL pointer dereference) inside auth_http_callback() in main/manager.c, the routine that processes HTTP-delivered AMI authentication requests when Digest Authentication is in use. The upstream commits show the defect precisely: failure paths that log a rejected login were formatting the client address via ast_sockaddr_stringify_addr(&session->addr), and on the HTTP transport path that embedded address structure is NULL, so the logging call dereferences a NULL pointer and terminates the process. The fix rebinds those log statements to a remote_address value that is actually populated for HTTP sessions, i.e. a straightforward NULL-guard-by-construction rather than a memory-safety redesign. Because the crash occurs during an authentication attempt, no valid AMI credentials are required - the CVSS vector PR:N reflects that. The vulnerable surface spans the Asterisk HTTP server (manager HTTP binding in http.conf/manager.conf) and the AMI protocol, both of which are disabled by default, and the HTTP listener's default bind address of 127.0.0.1 further constrains who can reach the code path. The trigger specifics beyond 'Digest Authentication over HTTP hits the socket-address logging path' are not described in the available sources.
Know when Asterisk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network request crashes the service (A:H, PR:N, UI:N); configuration preconditions are deployment state, not base-metric AC, and confidentiality/integrity are unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP. The Asterisk HTTP web server, AMI, and AMI access via HTTP must all be enabled; each is disabled by default. The attacker must be able to connect to the HTTP server, which binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Technical POC Analysis
CWE-476, NULL pointer dereference.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Asterisk's AMI component contains a NULL pointer dereference (CVE-2026-57195) that a remote unauthenticated attacker could use to crash the telephony server, but only if the HTTP server, AMI, and AMI-over-HTTP are all enabled and the HTTP listener has been bound to a routable interface. Most deployments do not meet these non-default conditions, and no exploit code or active exploitation has been observed. However, for organizations matching the affected profile, an outage could disrupt business communications, so leadership should prioritize verification and patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and old
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cer
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. Ra
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteris
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified
An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x befor
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package
Exploit-DB