High severity7.5NVD Advisory· Published Apr 15, 2022· Updated Jun 17, 2026

CVE-2022-26498

Description

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Digium/Asterisk
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Range: >=16.15.0,<=16.25.1
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Asterisk/Asteriskllm-fuzzy
Range: <=19.x, fixed in 16.25.2, 18.11.2, and 19.3.2

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.htmlnvdPatchThird Party AdvisoryVDB Entry
downloads.asterisk.org/pub/security/AST-2022-001.htmlnvdPatchVendor Advisory
downloads.asterisk.org/pub/security/nvdVendor Advisory
lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlnvdMailing ListThird Party Advisory
www.debian.org/security/2022/dsa-5285nvdThird Party Advisory
packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.013
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000