CVE-2022-26498

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-15 · updated 2026-06-17
Weakness: CWE-400

Description

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Affected products

Debian Linux: 10.0, 11.0
Digium Asterisk: from 16.15.0 through 16.25.1; from 18.0 before 18.11.2; from 19.0.0 through 19.3.1 — fixed in 18.11.2

How to fix

Upgrade to a fixed version: Digium Asterisk 18.11.2. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.html
http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
https://downloads.asterisk.org/pub/security/
https://downloads.asterisk.org/pub/security/AST-2022-001.html
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
https://www.debian.org/security/2022/dsa-5285
http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.html
http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
https://downloads.asterisk.org/pub/security/
https://downloads.asterisk.org/pub/security/AST-2022-001.html
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
https://www.debian.org/security/2022/dsa-5285

Get alerted when CVE-2022-26498 or the next vulnerability affects your stack