Skip to content
OpenAdvisories
Medium WID-SEC-2026-1378 4 CVEs

Asterisk (pjproject): Mehrere Schwachstellen

Published May 5, 2026 · Updated Nov 4, 2026 · Revision 3 · de-DE

Vendor: Debian Vendor: Fedora Product: Linux Product: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Asterisk ausnutzen, um einen Denial-of-Service-Zustand oder eine Speicherbeschädigung zu verursachen, was möglicherweise die Ausführung von Code, die Umgehung von Sicherheitsmaßnahmen oder andere nicht näher spezifizierte Auswirkungen ermöglicht.

Product

Asterisk ist eine komplette Open Source Multiprotokoll Telefonanlage (PBX) auf Softwarebasis.

Vulnerabilities 4

  • High 8.7
    CVE-2026-28799

    PJSIP: Heap use-after-free in PJSIP presence subscription termination handler

    PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework (evsub.c) that is triggered during presence unsubscription (SUBSCRIBE with…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 8.1
    CVE-2026-25994 Public exploit

    PJSIP has a heap buffer overflow in ICE with long username

    PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a buffer overflow vulnerability exists in PJNATH ICE Session when processing credentials with excessively long usernames.

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • High 8.0
    CVE-2026-32942

    PJSIP has ICE session use-after-free race conditions

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. Thi…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2026-33069

    PJSIP has an Out-of-bounds Read in SIP multipart parsing

    PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip_multipart_parse(). After boundary string matching, curptr is advanced past the delimiter without verifying…

    pjsip pjproject asterisk pjproject Debian Ubuntu Alpine

Revision history

  1. #3

    Neue Updates von Fedora aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References