Loading story…
The Asterisk Development Team released patched versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certified build 22.8-cert3 to address 19 to 20 security advisories across the telephony platform. The fixes span ARI, PJSIP, H.323, XMPP, LDAP, HTTP, SMS handling, Codec2, OGG/Speex playback, logging utilities, and other components, covering buffer overflows, out-of-bounds reads and writes, use-after-free, SQL and LDAP injection, reflected XSS, null pointer dereference, privilege escalation, information disclosure, and conditional remote code execution. Asterisk also added ACL support for the built-in HTTP server and ARI in some branches and changed ARI behavior so dangerous dialplan functions now require live_dangerously to be enabled in asterisk.conf.
Notable issues included an ARI REST-over-WebSocket authorization bypass that could let a read-only user load arbitrary module paths and potentially reach conditional RCE, an ARI setChannelVar flaw that bypassed live_dangerously protections and permitted write-capable dialplan functions such as FILE(), and an ast_loggrabber weakness that could execute a Python script from a world-writable /tmp location, leading to privilege escalation and possible RCE. Additional advisories covered an unauthenticated AMI-over-HTTP digest authentication null-pointer dereference that could crash exposed systems, a crafted UNISTIM DIALPAGE packet that could overflow phone_number and crash Asterisk, a malformed OGG/Speex audio file that could trigger a heap overflow and denial of service, and a T.140 RED heap overflow in deprecated chan_sip that could allow an authenticated attacker to crash Asterisk or potentially execute code under specific configurations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-25, Asterisk published GitHub security advisories detailing multiple flaws, including a UNISTIM out-of-bounds write, an AMI HTTP digest-auth NULL dereference, an OGG/Speex heap overflow, a T.140 RED heap overflow, and an ARI setChannelVar live_dangerously bypass. The advisories identified affected versions and mapped fixes to the newly released patched branches.
On 2026-06-25, the Asterisk Development Team released security updates 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certified-22.8-cert3. The releases addressed 19-20 security advisories across multiple components and included changes such as stricter ARI handling and, on some branches, added ACL support for the built-in HTTP server and ARI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
14 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourcedownloads.asterisk.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **PJSIP** affecting version `2.16` and earlier, exposing the widely used multimedia communication library to memory corruption risks. `CVE-2026-40614` is a **heap buffer overflow** in the Opus codec decode path, where insufficient validation of buffer sizes allows `codec_decode()` to copy more data than allocated after `codec_parse()` emits encoded frames larger than the FEC decode buffer calculation anticipates. The flaw is tied to unchecked `pj_memcpy()` operations and was classified as `CWE-122`, with high potential impact to confidentiality, integrity, and availability. A second issue, `CVE-2026-40892`, is a **stack buffer overflow** in `pjsip_auth_create_digest2()` when pre-computed digest credentials are supplied through `PJSIP_CRED_DATA_DIGEST`. In that path, credential data is copied using `cred_info->data.slen` without enforcing the expected digest-length limit, allowing overflow of the fixed 128-byte `ha1` stack buffer. The vulnerability was classified as `CWE-121`, and both CVEs were published with GitHub advisory references and fixing commits, indicating that maintainers have issued patches for affected deployments.
Jun 29, 2026
The Canadian Centre for Cyber Security issued advisory **AV26-818** warning that multiple FreePBX components contain vulnerabilities requiring immediate updates. Affected modules include **backup**, **framework**, **missedcall**, **music**, **tts**, and **ucp** across FreePBX 16 and 17 branches, with the notice directing administrators to review FreePBX's published security advisories and apply patched releases. The most severe flaws include **`CVE-2026-73665`**, an unauthenticated remote code execution bug in **UCP** caused by a Socket.IO namespace authentication bypass and AMI action injection, fixed in **UCP 17.0.9**, and **`CVE-2026-73663`**, an unauthenticated SQL injection in **missedcall** via inbound Caller ID name that can enable administrator takeover, fixed in **missedcall 16.0.11** and **17.0.4**. Additional high-severity issues include **`CVE-2026-73664`** in the **Backup** module, which can inject an SSH key into `authorized_keys` for persistent shell access and is fixed in **Backup 17.0.11**, and **`CVE-2026-73661`** in the **Framework** module, where a crafted backup can restore `AUTHTYPE=none` and weaken authentication, fixed in **Framework 16.0.47** and **17.0.30**.
Aug 15, 2026
FreeSWITCH released fixes in **v1.11.1** for two critical pre-authentication heap buffer overflow vulnerabilities that could crash exposed voice servers and may enable remote code execution. The most severe issue, **`CVE-2026-49841`** (**CVSS 9.8**), affects the `mod_verto` HTTP request handler: affected versions before 1.11.1 allocate a fixed **2 MiB** buffer for `application/x-www-form-urlencoded` POST bodies while accepting a `Content-Length` of nearly **10 MiB**, allowing an attacker to overflow the heap by roughly **8 MiB** over the network before HTTP basic authentication is checked. A second flaw, **`CVE-2026-49840`** (**CVSS 9.1**), affects the `libesl` library, where `esl_recv_event()` uses `atol()` to parse `Content-Length` and passes the result to `malloc()` without final validation, creating a path to memory corruption or denial of service through negative values. Although no public exploit was reported, both bugs were described as easy to trigger, prompting guidance to upgrade immediately to **FreeSWITCH v1.11.1**, restrict Verto and ESL access to trusted networks, remove Verto vhost entries, disable `mod_verto` if it is not needed, and isolate the control-plane network.
Jun 29, 2026