CVE-2026-23738

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23738
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23738.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23738
Aliases
  • GHSA-v6hp-wh3r-cwxh
Downstream
Published
2026-02-06T16:41:43.769Z
Modified
2026-07-15T02:17:51.371243581Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
Details

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using aststrappend. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23738.json"
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d49c5d454f42fc11da7631bea496c66c6473798e
Last affected
85601849c646709836f59007d04ca829ef0d5955
Introduced
12da95e53ff42287ad69d6d5922e06c3d62010ac
Last affected
f0da54060ab01d91d9ddb78d1e5851bb489bbc90
Introduced
8e4a09f71162ebc1e4bb2159dfc638aa2328047c
Last affected
ce9bf76d69f960dcce55f09bec064248e0ec82dc
Introduced
3bb594c9ca712342edeba7d0610af12c08929737
Fixed
65a52c176730f95b3377e8105c189e580e61f926
Introduced
d8a0290d4a8b0ece3955f9c7b895659f8eba88f2
Last affected
4f31258df77cd9435e014bb526c762a2a036827a
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "20.18.2"
        },
        {
            "last_affected": "18.9"
        },
        {
            "introduced": "21.0.0"
        },
        {
            "last_affected": "21.12.1"
        },
        {
            "introduced": "22.0.0"
        },
        {
            "last_affected": "22.8.2"
        },
        {
            "introduced": "23.0.0"
        },
        {
            "fixed": "23.2.2"
        },
        {
            "introduced": "20.7-cert1"
        },
        {
            "last_affected": "20.7-cert1"
        },
        {
            "introduced": "20.7-cert1\\-rc1"
        },
        {
            "last_affected": "20.7-cert1\\-rc1"
        },
        {
            "introduced": "20.7-cert1\\-rc2"
        },
        {
            "last_affected": "20.7-cert1\\-rc2"
        },
        {
            "introduced": "20.7-cert2"
        },
        {
            "last_affected": "20.7-cert2"
        },
        {
            "introduced": "20.7-cert3"
        },
        {
            "last_affected": "20.7-cert3"
        },
        {
            "introduced": "20.7-cert4"
        },
        {
            "last_affected": "20.7-cert4"
        },
        {
            "introduced": "20.7-cert5"
        },
        {
            "last_affected": "20.7-cert5"
        },
        {
            "introduced": "20.7-cert6"
        },
        {
            "last_affected": "20.7-cert6"
        },
        {
            "introduced": "20.7-cert7"
        },
        {
            "last_affected": "20.7-cert7"
        },
        {
            "introduced": "20.7-cert8"
        },
        {
            "last_affected": "20.7-cert8"
        }
    ],
    "cpe": [
        "cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*",
        "cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:*"
    ]
}

Affected versions

18.*
18.9.0
18.9.0-rc1
20.*
20.10.0
20.10.0-rc1
20.10.0-rc2
20.11.0
20.11.0-rc1
20.11.1
20.12.0
20.12.0-rc1
20.12.0-rc2
20.13.0
20.13.0-rc1
20.14.0
20.14.0-rc1
20.15.0
20.15.0-rc1
20.15.0-rc2
20.15.0-rc3
20.15.1
20.15.2
20.16.0
20.16.0-rc1
20.16.0-rc2
20.17.0
20.17.0-rc1
20.17.0-rc2
20.18.0
20.18.0-rc1
20.18.1
20.18.2
20.2.0
20.2.0-rc1
20.2.1
20.3.0
20.3.0-rc1
20.3.1
20.4.0
20.4.0-rc1
20.4.0-rc2
20.5.0
20.5.0-rc1
20.5.1
20.5.2
20.6.0
20.6.0-rc1
20.6.0-rc2
20.7-cert1
20.7-cert1\-rc1
20.7-cert1\-rc2
20.7-cert2
20.7-cert3
20.7-cert4
20.7-cert5
20.7-cert6
20.7-cert7
20.7-cert8
20.7.0
20.7.0-rc1
20.7.0-rc2
20.8.0
20.8.0-rc1
20.8.1
20.9.0
20.9.0-rc1
20.9.1
20.9.2
20.9.3
21.*
21.0.0
21.0.1
21.0.2
21.1.0
21.1.0-rc1
21.1.0-rc2
21.10.0
21.10.0-rc1
21.10.0-rc2
21.10.0-rc3
21.10.1
21.10.2
21.11.0
21.11.0-rc1
21.11.0-rc2
21.12.0
21.12.0-rc1
21.12.0-rc2
21.12.1
21.2.0
21.2.0-rc1
21.2.0-rc2
21.3.0
21.3.0-rc1
21.3.1
21.4.0
21.4.0-rc1
21.4.1
21.4.2
21.4.3
21.5.0
21.5.0-rc1
21.5.0-rc2
21.6.0
21.6.0-rc1
21.6.1
21.7.0
21.7.0-rc1
21.7.0-rc2
21.8.0
21.8.0-rc1
21.9.0
21.9.0-rc1
22.*
22.0.0
22.1.0
22.1.0-rc1
22.1.1
22.2.0
22.2.0-rc1
22.2.0-rc2
22.3.0
22.3.0-rc1
22.4.0
22.4.0-rc1
22.5.0
22.5.0-rc1
22.5.0-rc2
22.5.0-rc3
22.5.1
22.5.2
22.6.0
22.6.0-rc1
22.6.0-rc2
22.7.0
22.7.0-rc1
22.7.0-rc2
22.8.0
22.8.0-rc1
22.8.1
22.8.2
23.*
23.0.0
23.1.0
23.1.0-rc1
23.1.0-rc2
23.2.0
23.2.0-rc1
23.2.1
certified-20.*
certified-20.7-cert1
certified-20.7-cert1-pre1
certified-20.7-cert2
certified-20.7-cert3
certified-20.7-cert4
certified-20.7-cert5
certified-20.7-cert6
certified-20.7-cert7
certified-20.7-cert8
certified-22.*
certified-22.8-cert1
certified-22.8-cert1-pre1
certified-22.8-cert1-rc1
certified-22.8-cert2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23738.json"