CVE-2026-23738

EUVD-2026-5645
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
GitHub_MCNA
3.5 LOW
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Affected Products (NVD)
VendorProductVersion
sangomaasterisk
𝑥
≤ 20.18.2
sangomaasterisk
21.0.0 ≤
𝑥
≤ 21.12.1
sangomaasterisk
22.0.0 ≤
𝑥
≤ 22.8.2
sangomaasterisk
23.0.0 ≤
𝑥
< 23.2.2
sangomacertified_asterisk
𝑥
≤ 18.9
sangomacertified_asterisk
20.7:cert1
sangomacertified_asterisk
20.7:cert1-rc1
sangomacertified_asterisk
20.7:cert1-rc2
sangomacertified_asterisk
20.7:cert2
sangomacertified_asterisk
20.7:cert3
sangomacertified_asterisk
20.7:cert4
sangomacertified_asterisk
20.7:cert5
sangomacertified_asterisk
20.7:cert6
sangomacertified_asterisk
20.7:cert7
sangomacertified_asterisk
20.7:cert8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
asterisk
bullseye
vulnerable
bullseye (security)
vulnerable
sid
1:22.8.2+dfsg+~cs6.15.60671435-1
fixed