{
  "cveId": "CVE-2026-57190",
  "url": "https://patchblox.com/security/cve/CVE-2026-57190",
  "summary": "CVE-2026-57190 is fixed in asterisk on 1 platform by DEBIAN-CVE-2026-57190 (version 1:22.10.1\u002Bdfsg\u002B~cs6.17.60671434-1), released October 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "asterisk: Asterisk is an open source private branch exchange and telephony toolkit",
  "description": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the \u0060PostgreSQL\u0060 and \u0060TDS/MSSQL\u0060 Channel Event Log backends \u0060cel_pgsql\u0060 and \u0060cel_tds\u0060 may permit arbitrary SQL execution when untrusted data is set in the CEL \u0060eventtype\u0060 column by the \u0060CELGenUserEvent\u0060 dialplan application. The \u0060cel_pgsql\u0060 or \u0060cel_tds\u0060 backend must be loaded and configured, and the administrator must call \u0060CELGenUserEvent\u0060 in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.",
  "published": "2026-10-27T22:17:27Z",
  "severity": "",
  "epss": 0.00679,
  "epssPercentile": 0.52607,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "asterisk",
      "release": "Debian 14",
      "fixedVersion": "1:22.10.1\u002Bdfsg\u002B~cs6.17.60671434-1",
      "fix": "DEBIAN-CVE-2026-57190",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-57190",
      "released": "2026-10-28T21:27:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}