CVE-2026-57193

The record

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected packages

Related vulnerabilities

• CVE-2026-118645 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter… CWE-943
• CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData… CWE-943
• CVE-2026-118581 A BSON encoding component of the MongoDB Java Driver does not verify that an externally… CWE-943
• CVE-2026-55369 Waline is a comment system with backend support. CWE-943
• CVE-2026-116801 Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning… CWE-943
• CVE-2026-55465 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943
• CVE-2026-55444 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-943
• CVE-2026-114652 A data-query-logic neutralization weakness in the update-statement construction component… CWE-943