CVE-2026-57191
Description
A flaw was found in Asterisk. An unbounded string parsing vulnerability in the res_pjsip_pubsub module allows an unauthenticated remote attacker to trigger a stack-based buffer overflow by sending a specially crafted Message Waiting Indication (MWI) NOTIFY packet. Successful exploitation leads to a Denial of Service (DoS) by corrupting the network transport and disabling all Session Initiation Protocol (SIP) functionality until the service is restarted.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger a denial of service across all SIP communications without user interaction, although it does not allow data compromise or code execution. Asterisk is not included in core Red Hat Enterprise Linux releases, though it is distributed via community channels like EPEL and Fedora. Deployments utilizing the PJSIP stack and handling inbound Message Waiting Indication (MWI) NOTIFY requests are susceptible to transport corruption that halts telephony operations until the service is restarted.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to bound string parsing in res_pjsip_pubsub to prevent stack buffer overflow when processing Message-Account headers: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 (or the fixed Asterisk builds), which restrict sscanf input with a %511s width specifier into the 512-byte buffer, closing crafted SIP MWI NOTIFY packet with an oversized Message-Account header. Until patched, this is a concern on Asterisk deployments using res_pjsip_pubsub with exposed SIP/PJSIP ports, so restrict network access to the Asterisk SIP/PJSIP port to trusted IP addresses only. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded sscanf stack buffer overflow — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
