CVE-2026-57193
Description
A flaw was found in Asterisk's res_config_ldap module. An unauthenticated remote attacker can exploit this flaw to cause information disclosure through Lightweight Directory Access Protocol (LDAP) filter injection. By sending specially crafted Session Initiation Protocol (SIP) packets with a manipulated username, an attacker can execute arbitrary LDAP queries and retrieve sensitive directory data when the module is configured to connect to an LDAP server.
Statement
This vulnerability is rated as Moderate impact because, while unauthenticated remote actors can trigger arbitrary queries over SIP, the flaw is strictly confined to unauthorized directory information disclosure and does not grant code execution or service disruption. In typical Red Hat environments, the vulnerable res_config_ldap module is not loaded or configured by default, as directory-backed realtime storage requires explicit administrative setup. Telephony deployments that do not integrate Asterisk with an LDAP backend remain completely unaffected.
Mitigation
No known mitigations are currently available for this CVE. The recommended course of action is to apply the security updates once they are released by Red Hat.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
