main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade asterisk | Sep 20, 2017 | Apr 1, 2013 |
| Debian | — | Upgrade asterisk | Jul 30, 2024 | Apr 1, 2013 |
| Freebsd | — | Upgrade asterisk10Upgrade asterisk18Upgrade asterisk11 | Dec 10, 2025 | Mar 29, 2013 |
| Gentoo Linux | — | Upgrade net-misc/asterisk. | Oct 30, 2017 | Apr 1, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub