CVE-2026-57195
Description
A flaw was found in Asterisk. An unauthenticated remote attacker can cause a Denial of Service (DoS) by exploiting a null pointer dereference within the Asterisk Manager Interface (AMI). When HTTP digest authentication is configured, sending a specially crafted request crashes the Asterisk service, disrupting telephony operations.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can terminate the core telephony service, resulting in a complete loss of availability. Successful exploitation requires non-default settings, as the integrated web server, the management interface, and HTTP access to the interface must all be manually enabled. Additionally, even if enabled, the listener binds only to localhost by default, preventing external exposure unless explicitly reconfigured.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable HTTP access to the Asterisk Manager Interface or disable HTTP digest authentication in Asterisk: upgrade to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11, 22.8-cert3 (or the fixed Asterisk builds), which replace session->addr dereference with remote_address in auth_http_callback failure logging, closing all 2 injection vectors (HTTP Digest authentication request with nonexistent username, HTTP Digest authentication request from an IP failing user ACL validation). Until patched, this is a concern on Asterisk instances with HTTP server, Asterisk Manager Interface, HTTP AMI access, and HTTP Digest Authentication enabled, so restrict network access to the Asterisk HTTP listener, keep the listener bound to localhost, or disable HTTP access to AMI. These controls limit blast radius and contain exploitation, but they do not fix the underlying null pointer dereference defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
