CVE-2026-23738
EUVD-2026-564506.02.2026, 17:16
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| sangoma | asterisk | 𝑥 ≤ 20.18.2 |
| sangoma | asterisk | 21.0.0 ≤ 𝑥 ≤ 21.12.1 |
| sangoma | asterisk | 22.0.0 ≤ 𝑥 ≤ 22.8.2 |
| sangoma | asterisk | 23.0.0 ≤ 𝑥 < 23.2.2 |
| sangoma | certified_asterisk | 𝑥 ≤ 18.9 |
| sangoma | certified_asterisk | 20.7:cert1 |
| sangoma | certified_asterisk | 20.7:cert1-rc1 |
| sangoma | certified_asterisk | 20.7:cert1-rc2 |
| sangoma | certified_asterisk | 20.7:cert2 |
| sangoma | certified_asterisk | 20.7:cert3 |
| sangoma | certified_asterisk | 20.7:cert4 |
| sangoma | certified_asterisk | 20.7:cert5 |
| sangoma | certified_asterisk | 20.7:cert6 |
| sangoma | certified_asterisk | 20.7:cert7 |
| sangoma | certified_asterisk | 20.7:cert8 |
𝑥
= Vulnerable software versions
Debian Releases