CVE-2022-26498

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
https://downloads.asterisk.org/pub/security/Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-001.htmlPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5285Third Party Advisory
http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.htmlPatch, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
https://downloads.asterisk.org/pub/security/Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2022-001.htmlPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2022/dsa-5285Third Party Advisory

Timeline

Published: Apr 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-264999.1An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to int CVE-2022-26509.8Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.CVE-2022-265008.8Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte CVE-2022-265019.8Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).CVE-2022-265037.8Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code wit CVE-2022-265048.8Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine CVE-2022-265057.4A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.CVE-2022-265079.8A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote cod CVE-2022-265087.5Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information di CVE-2022-265095.5Improper conditions check in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via loca CVE-2022-26519.8Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.CVE-2022-265106.5A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafte