{
  "cveId": "CVE-2026-57191",
  "url": "https://patchblox.com/security/cve/CVE-2026-57191",
  "summary": "CVE-2026-57191 is fixed in asterisk on 1 platform by DEBIAN-CVE-2026-57191 (version 1:22.10.1\u002Bdfsg\u002B~cs6.17.60671434-1), released October 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "asterisk: Asterisk is an open source private branch exchange and telephony toolkit",
  "description": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded \u0060sscanf\u0060 in \u0060res_pjsip_pubsub\u0060 when parsing the \u0060MWI NOTIFY\u0060 \u0060Message-Account\u0060 field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.",
  "published": "2026-10-27T22:17:27Z",
  "severity": "",
  "epss": 0.00592,
  "epssPercentile": 0.48529,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "asterisk",
      "release": "Debian 14",
      "fixedVersion": "1:22.10.1\u002Bdfsg\u002B~cs6.17.60671434-1",
      "fix": "DEBIAN-CVE-2026-57191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-57191",
      "released": "2026-10-28T21:27:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}