CVE-2025-57767
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.41%
- CWE
- CWE-253
- Published
- 2025-08-28
- Last modified
- 2026-03-13
Affected products
- asterisk asterisk
- asterisk asterisk
- asterisk asterisk
Weakness type
Related vulnerabilities
- CVE-2026-15686 — Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability
- CVE-2026-59847 — Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
- CVE-2026-5818 — MCU Firmware Update Authentication Bypass on Caliptra Core
- CVE-2026-46419 — Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a...
- CVE-2026-43863 — mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
- CVE-2026-35340 — uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode
- CVE-2026-35339 — uutils coreutils chmod False Success Exit Code in Recursive Mode
- CVE-2026-35091 — Corosync: corosync: denial of service and information disclosure via crafted udp packet