VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Feb 19, 2021· Updated Jun 17, 2026

CVE-2021-26713

CVE-2021-26713

Description

A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

17
  • Digium/Asterisk
    cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
    Range: >=16.0.0,<16.16.1
  • Digium/Certified Asterisk13 versions
    cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:digium:certified_asterisk:16.8:-:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert2:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert3:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert4:*:*:*:*:*:*
    • cpe:2.3:a:digium:certified_asterisk:16.8:cert5:*:*:*:*:*:*
  • Sangoma/Asteriskdescription
  • Freepbx/Certified Asteriskllm-create
    Range: <16.8-cert6
  • Freepbx/Asteriskllm-create
    Range: <16.16.1, 17.x <17.9.2, 18.x <18.2.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.