What’s Vulnerable › Vulnerabilities
CVE-2026-23738: The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-06 · updated 2026-06-17
- Weakness: CWE-79
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected products
- asterisk: through 20.18.2; from 21.0.0 through 21.12.1; from 22.0.0 through 22.8.2; from 23.0.0 before 23.2.2 — fixed in 23.2.2
- Sangoma Certified Asterisk: through 18.9; 20.7-cert1, 20.7-cert1-rc1, 20.7-cert1-rc2, 20.7-cert2, 20.7-cert3, 20.7-cert4 (+4)
How to fix
Upgrade to a fixed version: asterisk 23.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23738 or the next vulnerability affects your stack