CVE-2026-57193Medium· 6.9▾ SunlitAsterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP fil…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
2.0%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
asterisk < 20.20.1asterisk >= 21.0.0-pre1, < 21.12.3asterisk >= 22.0.0-pre1, < 22.10.1asterisk >= 23.0.0-pre1, < 23.4.1certified-asterisk < 20.7-cert11certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57199Low· 2.3Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
CVE-2026-57195High· 7.5Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
CVE-2026-57200High· 7.5Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
CVE-2026-57186High· 7.5Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
CVE-2026-57192Medium· 6.0Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
CVE-2026-57191High· 8.2Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing