CVE catalog
CVE-2026-57189
UBUNTU-
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
- Severity
- Unknown · CVSS 2.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "asterisk",
"distro": "debian",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.10.1+dfsg+~cs6.17.60671434-1"
}
]
}
],
"release": "14",
"versions": [
"0.1.11-3",
"0.1.11-3woody1",
"1:1.0.5-2",
"1:1.0.5-4",
"1:1.0.6-1",
"1:1.0.6-2",
"1:1.0.7-1",
"1:1.0.7.dfsg.1-1",
"1:1.0.7.dfsg.1-2",
"1:1.0.7.dfsg.1-2sarge1",
"1:1.0.7.dfsg.1-2sarge2",
"1:1.0.7.dfsg.1-2sarge3",
"1:1.0.7.dfsg.1-2sarge4",
"1:1.0.7.dfsg.1-2sarge5",
"1:1.0.7.dfsg.1-2sarge6",
"1:1.0.9.dfsg-1",
"1:1.0.9.dfsg-3",
"1:1.0.9.dfsg-4",
"1:1.0.9.dfsg-5",
"1:1.0.9.dfsg-6",
"1:1.2.0-beta1.dfsg-1",
"1:1.2.0-beta2.dfsg-1",
"1:1.2.0-beta2.dfsg-2",
"1:1.2.0-beta2.dfsg-3",
"1:1.2.0-rc1.dfsg-1",
"1:1.2.0-rc2.dfsg-1",
"1:1.2.0.dfsg-1",
"1:1.2.0.dfsg-2",
"1:1.2.0.dfsg-3",
"1:1.2.0.dfsg-4",
"1:1.2.0.dfsg-5",
"1:1.2.0.dfsg-6",
"1:1.2.1.dfsg-1",
"1:1.2.1.dfsg-2",
"1:1.2.1.dfsg-3",
"1:1.2.10.dfsg-1",
"1:1.2.10.dfsg-1bpo1",
"1:1.2.10.dfsg-2",
"1:1.2.10.dfsg-3",
"1:1.2.11.dfsg-1",
"1:1.2.12.1.dfsg-1",
"1:1.2.13~dfsg-1",
"1:1.2.13~dfsg-2",
"1:1.2.13~dfsg-2etch1",
"1:1.2.13~dfsg-2etch2",
"1:1.2.13~dfsg-2etch3",
"1:1.2.13~dfsg-2etch4",
"1:1.2.14~dfsg-1",
"1:1.2.14~dfsg-2",
"1:1.2.14~dfsg-3",
"1:1.2.14~dfsg-4",
"1:1.2.15~dfsg-1",
"1:1.2.16~dfsg-1",
"1:1.2.17~dfsg-1",
"1:1.2.4.dfsg-1",
"1:1.2.4.dfsg-2",
"1:1.2.4.dfsg-3",
"1:1.2.4.dfsg-4",
"1:1.2.4.dfsg-5",
"1:1.2.4.dfsg-6",
"1:1.2.4.dfsg-6+b1",
"1:1.2.4.dfsg-7",
"1:1.2.7.1.dfsg-1",
"1:1.2.7.1.dfsg-2",
"1:1.2.7.1.dfsg-3",
"1:1.2.9.1.dfsg-1",
"1:1.4.10~dfsg-1",
"1:1.4.11~dfsg-1",
"1:1.4.11~dfsg-2",
"1:1.4.11~dfsg-3",
"1:1.4.11~dfsg-4",
"1:1.4.13~dfsg-1",
"1:1.4.15~dfsg-1",
"1:1.4.16.2~dfsg-1",
"1:1.4.16.2~dfsg-2",
"1:1.4.17~dfsg-1",
"1:1.4.17~dfsg-2",
"1:1.4.18.1~dfsg-1",
"1:1.4.18~dfsg-1",
"1:1.4.19.1~dfsg-1",
"1:1.4.20~dfsg-1",
"1:1.4.21.1~dfsg-1",
"1:1.4.21.2~dfsg-1",
"1:1.4.21.2~dfsg-2",
"1:1.4.21.2~dfsg-3",
"1:1.4.21.2~dfsg-3+lenny1",
"1:1.4.21.2~dfsg-3+lenny2",
"1:1.4.21.2~dfsg-3+lenny2.1",
"1:1.4.21.2~dfsg-3+lenny3",
"1:1.4.21.2~dfsg-3+lenny5",
"1:1.4.21.2~dfsg-3+lenny6",
"1:1.4.21.2~dfsg-3.1",
"1:1.4.2~dfsg-1",
"1:1.4.2~dfsg-2",
"1:1.4.2~dfsg-3",
"1:1.4.2~dfsg-4",
"1:1.4.2~dfsg-5",
"1:1.4.3~dfsg-1",
"1:1.4.4~dfsg-1",
"1:1.4.4~dfsg-2",
"1:1.4.4~dfsg-3",
"1:1.4.5~dfsg-1",
"1:1.4.6~dfsg-1",
"1:1.4.8~dfsg-1",
"1:1.4.8~dfsg-2",
"1:1.4.9~dfsg-1",
"1:1.6.1.0~dfsg-1",
"1:1.6.1.0~dfsg~rc3-1",
"1:1.6.2.0-1",
"1:1.6.2.0~dfsg~beta3-1",
"1:1.6.2.0~dfsg~rc1-1",
"1:1.6.2.0~rc3-1",
"1:1.6.2.0~rc3-2",
"1:1.6.2.0~rc6-1",
"1:1.6.2.0~rc7-1",
"1:1.6.2.2-1",
"1:1.6.2.6-1",
"1:1.6.2.7-1",
"1:1.6.2.9-1",
"1:1.6.2.9-1~bpo50+1",
"1:1.6.2.9-1~bpo50+2",
"1:1.6.2.9-1~bpo50+3",
"1:1.6.2.9-2",
"1:1.6.2.9-2+squeeze1",
"1:1.6.2.9-2+squeeze10",
"1:1.6.2.9-2+squeeze11",
"1:1.6.2.9-2+squeeze12",
"1:1.6.2.9-2+squeeze2",
"1:1.6.2.9-2+squeeze3",
"1:1.6.2.9-2+squeeze4",
"1:1.6.2.9-2+squeeze5",
"1:1.6.2.9-2+squeeze6",
"1:1.6.2.9-2+squeeze7",
"1:1.6.2.9-2+squeeze8",
"1:1.6.2.9-2+squeeze9",
"1:1.8.10.0~dfsg-1",
"1:1.8.10.1~dfsg-1",
"1:1.8.11.1~dfsg-1",
"1:1.8.13.0~dfsg-1",
"1:1.8.13.0~dfsg-1~bpo60+1",
"1:1.8.13.1~dfsg-1",
"1:1.8.13.1~dfsg-1+powerpcspe1",
"1:1.8.13.1~dfsg-1~bpo60+1",
"1:1.8.13.1~dfsg-2",
"1:1.8.13.1~dfsg-3",
"1:1.8.3.3-1",
"1:1.8.4-1",
"1:1.8.4.2-1",
"1:1.8.4.3-1",
"1:1.8.4.4~dfsg-1",
"1:1.8.4.4~dfsg-2",
"1:1.8.7.1~dfsg-1",
"1:1.8.7.1~dfsg-2",
"1:1.8.7.1~dfsg-3",
"1:1.8.8.0~dfsg-1",
"1:1.8.8.2~dfsg-1",
"1:11.10.0~dfsg-1",
"1:11.10.0~dfsg-1~bpo70+1",
"1:11.10.2~dfsg-1",
"1:11.10.2~dfsg-1~bpo70+1",
"1:11.11.0~dfsg-1",
"1:11.11.0~dfsg-1~bpo70+1",
"1:11.11.0~dfsg-2",
"1:11.12.0~dfsg-1",
"1:11.12.0~dfsg-1~bpo70+1",
"1:11.12.1~dfsg-1",
"1:11.13.0~dfsg-1",
"1:11.13.0~dfsg-1~bpo70+1",
"1:11.13.1~dfsg-1",
"1:11.13.1~dfsg-2",
"1:11.13.1~dfsg-2~bpo70+1",
"1:11.5.1~dfsg-1",
"1:11.5.1~dfsg-2",
"1:11.5.1~dfsg1-1",
"1:11.5.1~dfsg1-1~bpo70+1",
"1:11.6.0~dfsg-1",
"1:11.6.0~dfsg-2",
"1:11.6.0~dfsg-3",
"1:11.7.0~dfsg-1",
"1:11.7.0~dfsg-1+e1",
"1:11.7.0~dfsg-1~bpo70+1",
"1:11.8.0~dfsg-1",
"1:11.8.0~dfsg-2",
"1:11.8.1~dfsg-1",
"1:11.8.1~dfsg-1~bpo70+1",
"1:11.9.0~dfsg-1",
"1:11.9.0~dfsg-2",
"1:11.9.0~dfsg-2~bpo70+1",
"1:13.0.0~dfsg-1",
"1:13.0.0~dfsg-2",
"1:13.1.0~dfsg-1",
"1:13.1.0~dfsg-1.1",
"1:13.10.0~dfsg-1",
"1:13.11.2~dfsg-1",
"1:13.12.1~dfsg-1",
"1:13.12.2~dfsg-1",
"1:13.12.2~dfsg-2",
"1:13.13.1~dfsg-1",
"1:13.13.1~dfsg-2",
"1:13.13.1~dfsg-3",
"1:13.13.1~dfsg-3~exp1",
"1:13.13.1~dfsg-4",
"1:13.14.0~dfsg-1",
"1:13.14.0~dfsg-1~exp1",
"1:13.14.1~dfsg-1",
"1:13.14.1~dfsg-2",
"1:13.17.0~dfsg-1",
"1:13.17.0~dfsg-2",
"1:13.17.1~dfsg-1",
"1:13.17.2~dfsg-1",
"1:13.17.2~dfsg-2",
"1:13.18.1~dfsg-1",
"1:13.18.3~dfsg-1",
"1:13.18.5~dfsg-1",
"1:13.20.0~dfsg-1",
"1:13.22.0~dfsg-1",
"1:13.22.0~dfsg-2",
"1:13.23.1~dfsg-1",
"1:13.23.1~dfsg-2",
"1:13.7.2~dfsg-1",
"1:13.8.0~dfsg-1",
"1:13.8.2~dfsg-1",
"1:13.9.1~dfsg-1",
"1:13.9.1~dfsg-2",
"1:16.1.0~dfsg-1",
"1:16.1.0~dfsg-2",
"1:16.1.0~dfsg-3",
"1:16.1.0~dfsg-4",
"1:16.1.1~dfsg-1",
"1:16.10.0~dfsg-1",
"1:16.12.0~dfsg-1",
"1:16.15.0~dfsg-1",
"1:16.15.1~dfsg-1",
"1:16.16.1~dfsg+~2.10-1",
"1:16.16.1~dfsg+~2.10-2",
"1:16.16.1~dfsg-1",
"1:16.16.1~dfsg-1~bpo10+1",
"1:16.16.1~dfsg-2",
"1:16.16.1~dfsg-3",
"1:16.16.1~dfsg-4",
"1:16.2.0~dfsg-1",
"1:16.2.1~dfsg-1",
"1:16.2.1~dfsg-2",
"1:16.23.0~dfsg+~2.10-1",
"1:16.23.0~dfsg+~cs6.10.20220309-1",
"1:16.23.0~dfsg+~cs6.10.20220309-2",
"1:16.23.0~dfsg+~cs6.10.40431411-1",
"1:18.10.0~dfsg+~cs6.10.40431411-1",
"1:18.10.0~dfsg+~cs6.10.40431411-2",
"1:18.10.1~dfsg+~cs6.10.40431411-1",
"1:18.11.1~dfsg+~cs6.10.40431413-1",
"1:18.11.2~dfsg+~cs6.10.40431413-1",
"1:18.12.0~dfsg+~cs6.12.40431413-1",
"1:18.14.0~dfsg+~cs6.12.40431414-1",
"1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1",
"1:18.9.0~dfsg+~cs6.10.40431411-1",
"1:20.0.0~dfsg+~cs6.12.40431414-1",
"1:20.0.0~dfsg+~cs6.12.40431414-2",
"1:20.0.0~~rc1~dfsg+~cs6.12.40431414-1",
"1:20.0.0~~rc2~dfsg+~cs6.12.40431414-1",
"1:20.0.1~dfsg+~cs6.12.40431414-1",
"1:20.1.0~dfsg+~cs6.12.40431414-1",
"1:20.1.0~~rc2~dfsg+~cs6.12.40431414-1",
"1:20.2.1~dfsg+~cs6.13.40431413-1",
"1:20.3.0~dfsg+~cs6.13.40431413-1",
"1:20.4.0~dfsg+~cs6.13.40431414-1",
"1:20.4.0~dfsg+~cs6.13.40431414-2",
"1:20.5.0~dfsg+~cs6.13.40431414-1",
"1:20.5.1~dfsg+~cs6.13.40431414-1",
"1:20.5.2~dfsg+~cs6.13.40431414-1",
"1:20.6.0~dfsg+~cs6.13.40431414-1",
"1:20.6.0~dfsg+~cs6.13.40431414-2",
"1:20.8.1~dfsg+~cs6.14.40431414-1",
"1:20.9.3~dfsg+~cs6.14.60671435-1",
"1:22.0.0~dfsg+~cs6.14.60671435-1",
"1:22.0.0~~rc2~dfsg+~cs6.14.60671435-1",
"1:22.1.0~dfsg+~cs6.14.60671435-1",
"1:22.1.1~dfsg+~cs6.14.60671435-1",
"1:22.10.0+dfsg+~cs6.17.60671434-1",
"1:22.10.0+dfsg+~cs6.17.60671434-2",
"1:22.10.0+dfsg+~cs6.17.60671434-3",
"1:22.2.0~dfsg+~cs6.15.60671435-1",
"1:22.2.0~dfsg+~cs6.15.60671435-2",
"1:22.3.0~dfsg+~cs6.15.60671435-1",
"1:22.3.0~~rc1~dfsg+~cs6.15.60671435-1",
"1:22.4.1~dfsg+~cs6.15.60671435-1",
"1:22.4.1~dfsg+~cs6.15.60671435-2",
"1:22.5.1~dfsg+~cs6.15.60671435-1",
"1:22.5.2~dfsg+~cs6.15.60671435-1",
"1:22.6.0~dfsg+~cs6.15.60671435-1",
"1:22.7.0~dfsg+~cs6.15.60671435-1",
"1:22.8.0+dfsg+~cs6.15.60671435-1",
"1:22.8.2+dfsg+~cs6.15.60671435-1",
"1:22.9.0+dfsg+~cs6.16.60671434-1"
],
"ecosystem": "deb",
"fixed_version": "1:22.10.1+dfsg+~cs6.17.60671434-1",
"provider_record_id": "DEBIAN-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"1:13.1.0~dfsg-1.1ubuntu3",
"1:13.1.0~dfsg-1.1ubuntu4",
"1:13.1.0~dfsg-1.1ubuntu4.1",
"1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"1:13.17.2~dfsg-1ubuntu1",
"1:13.17.2~dfsg-2ubuntu1",
"1:13.18.1~dfsg-1ubuntu1",
"1:13.18.3~dfsg-1ubuntu1",
"1:13.18.3~dfsg-1ubuntu2",
"1:13.18.3~dfsg-1ubuntu3",
"1:13.18.3~dfsg-1ubuntu4"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"1:16.2.1~dfsg-2build2",
"1:16.2.1~dfsg-2build3",
"1:16.2.1~dfsg-2ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"1:16.16.1~dfsg-2",
"1:16.16.1~dfsg-4",
"1:16.16.1~dfsg-4build1",
"1:16.16.1~dfsg+~2.10-1",
"1:18.10.0~dfsg+~cs6.10.40431411-2"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "24.04",
"versions": [
"1:20.4.0~dfsg+~cs6.13.40431414-2",
"1:20.5.0~dfsg+~cs6.13.40431414-1",
"1:20.5.1~dfsg+~cs6.13.40431414-1",
"1:20.5.2~dfsg+~cs6.13.40431414-1",
"1:20.6.0~dfsg+~cs6.13.40431414-1",
"1:20.6.0~dfsg+~cs6.13.40431414-2",
"1:20.6.0~dfsg+~cs6.13.40431414-2build3",
"1:20.6.0~dfsg+~cs6.13.40431414-2build4",
"1:20.6.0~dfsg+~cs6.13.40431414-2build5"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.10",
"versions": [
"1:22.5.2~dfsg+~cs6.15.60671435-1",
"1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu2",
"1:22.10.0+dfsg+~cs6.17.60671434-1ubuntu3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
},
{
"name": "asterisk",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.04",
"versions": [
"1:22.5.2~dfsg+~cs6.15.60671435-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-57189"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed:
References
- [https://github.com/asterisk/asterisk/commit/0601c33d4edf8c8f221de91cead59460fb1e7180]
- [https://github.com/asterisk/asterisk/commit/111487298a954a029daae941eac423f0609b1261]
- [https://github.com/asterisk/asterisk/commit/536218a86b797996e8e8844deacc8207de373701]
- [https://github.com/asterisk/asterisk/commit/a89b61d7c756f816c7fa5327ead9e889f1531202]
- [https://github.com/asterisk/asterisk/commit/eaa108c68a32c080d7a168ef1d8bf784d5d830f4]
- [https://github.com/asterisk/asterisk/commit/eef894282be203cb9e6d8e9692e9c360a0b569b4]
- [https://github.com/asterisk/asterisk/commit/fde69a1f3ff17f507a1578ae27b528f43ceb5efd]
- [https://github.com/asterisk/asterisk/releases/tag/20.20.1]
- [https://github.com/asterisk/asterisk/releases/tag/21.12.3]
- [https://github.com/asterisk/asterisk/releases/tag/22.10.1]
- [https://github.com/asterisk/asterisk/releases/tag/23.4.1]
- [https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11]
- [https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3]
- [https://github.com/asterisk/asterisk/security/advisories/GHSA-j2mm-57pq-jh94]
- [https://github.com/asterisk/asterisk/tree/24.0.0-pre1]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-57189]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-57189]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-57189]
[National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]