Asterisk
162 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Asterisk, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.
Asterisk CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 2 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 3 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 4 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 162 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical11
- High56
- Medium85
- Low8
Latest CVEs
The 15 most recently published vulnerabilities affecting Asterisk.
- CVE-2026-23741ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation—
- CVE-2026-23740Asterisk vulnerable to potential privilege escalation—
- CVE-2026-23739Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection2.0
- CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization3.5
- CVE-2025-1131Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation7.8
- CVE-2025-57767Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request7.5
- CVE-2025-54995Asterisk remotely exploitable leak of RTP UDP ports and internal resources6.5
- CVE-2025-49832Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation6.5
- CVE-2025-47780cli_permissions.conf: deny option does not work for disallowing shell commands7.8
- CVE-2025-47779Using malformed From header can forge identity with ";" or NULL in name portion7.7
- CVE-2024-57520Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact...9.8
- CVE-2024-53566An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.5.5
- CVE-2024-42491A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used5.7
- CVE-2024-42365Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan7.4
- CVE-2024-35190Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests5.8
Product grouping is registry-driven, with AI assist and human review. How it works