© 2026 vulntracker.io

CVE-2021-26906

MEDIUM

5.9

CVSS Score

Published: February 18, 2021 at 07:50 PM UTC

Updated: June 17, 2026 at 03:43 AM UTC

2 products affected across 1 vendorAsteriskCertified Asterisk

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.9

Exploit prediction

EPSS 3%

Description

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asterisk · Digium

95%

13.0.0 ≤ v < 13.38.216.0.0 ≤ v < 16.16.117.0.0 ≤ v < 17.9.218.0 ≤ v < 18.2.1

Affected range stops below 13.38.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.16.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.9.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2.1, so it looks safe — our inference, not a vendor statement

Certified Asterisk · Digium

95%

16.8 16.8 cert1-rc1 16.8 cert1-rc2 16.8 cert1-rc3 16.8 cert1-rc4 16.8 cert2 16.8 cert3 16.8 cert4 16.8 cert4-rc1 16.8 cert4-rc2 16.8 cert4-rc3 16.8 cert4-rc4 16.8 cert5

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_MISCThird Party Advisory

Source: [email protected]

http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AST-2021-005.html

Mailing Listx_refsource_FULLDISCPatchThird Party Advisory

Source: [email protected]

http://seclists.org/fulldisclosure/2021/Feb/61

x_refsource_MISCVendor Advisory

Source: [email protected]

https://downloads.asterisk.org/pub/security/

x_refsource_CONFIRMVendor Advisory

Source: [email protected]

https://downloads.asterisk.org/pub/security/AST-2021-005.html

x_refsource_CONFIRMIssue TrackingPatchVendor Advisory

Source: [email protected]

https://issues.asterisk.org/jira/browse/ASTERISK-29196

CVSS

5.9MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-404

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card