What’s Vulnerable › Vulnerabilities

CVE-2019-7251

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-28 · updated 2026-06-17
• Weakness: CWE-190

Description

An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

Affected products

• Digium Asterisk: from 15.0.0 before 15.7.2; from 16.0.0 before 16.2.1 — fixed in 15.7.2, 16.2.1

How to fix

Upgrade to a fixed version: Digium Asterisk 15.7.2, 16.2.1. Check the vendor advisory for mitigations.

References

• https://downloads.asterisk.org/pub/security/AST-2019-001.html
• https://issues.asterisk.org/jira/browse/ASTERISK-28260
• https://downloads.asterisk.org/pub/security/AST-2019-001.html
• https://issues.asterisk.org/jira/browse/ASTERISK-28260

Get alerted when CVE-2019-7251 or the next vulnerability affects your stack