CVE-2025-57767

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-253

Affected software

Vendor	Product	Versions
asterisk	asterisk	< 22.5.2; < 21.10.2; < 20.15.2

References

https://github.com/asterisk/asterisk/commit/02993717b08f899d4aca9888062f35dfb198584fPatch
https://github.com/asterisk/asterisk/pull/1407Issue Tracking, Patch
https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5jVendor Advisory

Timeline

Published: Aug 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577686.9Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vul CVE-2025-577696.1FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick CVE-2025-57777.5Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN,CVE-2025-577705.3The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.CVE-2025-577718.1Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly hand CVE-2025-577729.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in Dat CVE-2025-577739.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filte CVE-2025-577747.8There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilen CVE-2025-577757.8There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vul CVE-2025-577767.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with D CVE-2025-577777.8There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. CVE-2025-577787.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file