General
RTSP
WebRTC
RPI Camera
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
Log inls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
The Asterisk Development Team would like to announce security release
Asterisk 23.4.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.4.1
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: Mike Bradeen
Date: 2022-06-06
When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.
Resolves: #GHSA-h5hv-jmgj-92q2
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
Resolves: #GHSA-wcvv-g26m-wx5c
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
The Asterisk Development Team would like to announce security release
Asterisk 22.10.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.10.1
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: Mike Bradeen
Date: 2022-06-06
When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.
Resolves: #GHSA-h5hv-jmgj-92q2
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
Resolves: #GHSA-wcvv-g26m-wx5c
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
The Asterisk Development Team would like to announce security release
Asterisk 21.12.3.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.3
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 21.12.3
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: Mike Bradeen
Date: 2022-06-06
When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.
Resolves: #GHSA-h5hv-jmgj-92q2
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
Resolves: #GHSA-wcvv-g26m-wx5c
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
Author: Mike Bradeen
Date: 2026-02-27
Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.
Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.
resolves: #1799
UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
Author: Joshua C. Colp
Date: 2026-02-12
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
The Asterisk Development Team would like to announce security release
Asterisk 20.20.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.20.1
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
Resolves: #GHSA-wcvv-g26m-wx5c
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
The Asterisk Development Team would like to announce security release
Certified Asterisk 22.8-cert3.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-22.8-cert3
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: Mike Bradeen
Date: 2022-06-06
When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.
Resolves: #GHSA-h5hv-jmgj-92q2
Author: George Joseph
Date: 2026-06-12
The REST over WebSocket path now properly prevents non-GET methods from
being executed on inbound WebSockets.
The query parameters from the original incoming GET request that caused the
upgrade to WebSocket are now passed to all REST requests that come from the
client. This ensures that if the client authenticated with a read-only
userid using the "api_key" query_string parameter, REST requests coming
in over the WebSocket will only be able to execute GETs on resources.
The HTTP headers were already passed to the REST requests so if the
client had authenticated via an "Authorization" it was properly handled.
New tests have been added to test_ari.c to check that read-only users
are properly denied access to resources using non-GET methods. Several
memory leaks were also squashed.
Resolves: #GHSA-wcvv-g26m-wx5c
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
Author: Mike Bradeen
Date: 2026-02-27
Add uri prefix based acl support to the built in http server.
This allows an acl to be added per uri prefix (ie '/metrics'
or '/ws') to restrict access.
Add user based acl support for ARI. This adds new acl options
to the user section of ari.conf to restrict access on a per
user basis.
resolves: #1799
UserNote: A new section, type=restriction has been added to http.conf
to allow an uri prefix based acl to be configured. See
http.conf.sample for examples and more information.
The user section of ari.conf can now contain an acl configuration
to restrict users access. See ari.conf.sample for examples and more
information
Author: Joshua C. Colp
Date: 2026-02-12
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
The Asterisk Development Team would like to announce security release
Certified Asterisk 20.7-cert11.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert11
/tmp) leading to potential privilege escalation And RCE/tmp) leading to potential privilege escalation And RCEAuthor: ThatTotallyRealMyth
Date: 2026-03-19
The ast_tsconvert.py script called by ast_loggrabber is now installed in a
temporary directory that isn't world readable or writable.
Resolves: #GHSA-xgj6-2gc5-5x9c
Author: George Joseph
Date: 2026-06-15
Add a check to key_dial_page() to ensure that dialed digits won't overrun
the phone_number field.
Resolves: #GHSA-3g56-cgrh-95p5
Author: George Joseph
Date: 2026-06-10
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable. That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign. pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable. pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.
Resolves: #GHSA-g8q2-p36q-94f6
Author: George Joseph
Date: 2026-06-02
Several bounds checks have been edded to ooQ931Decode to prevent it from
running past the end of the data buffer when parsing information elements.
Resolves: #GHSA-746q-794h-cc7f
Author: George Joseph
Date: 2026-05-21
DeveloperNote: ARI applications can no longer call "dangerous" dialplan
functions like DB(), FILE(), SHELL(), CURL(), STAT(), etc. without
enabling "live_dangerously" in asterisk.conf.
Resolves: #GHSA-vrfp-mg3q-3959
Author: George Joseph
Date: 2026-04-27
Add check to red_t140_to_red() to ensure that the new primary payload
can't cause the rtp_red->len array items to wrap or cause an overrun of
the rtp_red->t140red_data buffer.
Add check to rtp_red_buffer() to ensure that a T.140 frame to be sent
can't cause rtp_red->len array items to wrap or cause an overrun of
the rtp_red->buf_data buffer.
Resolves: #GHSA-vfhr-r9x9-c687
Resolves: #GHSA-j2mm-57pq-jh94
Author: Roberto Paleari
Date: 2026-04-29
Add constraint checks to prevent unauthenticated users from crashing Asterisk
instance by sending a crafted inbound SIP NOTIFY request with "Content-Type:
application/simple-message-summary".
Resolves: #GHSA-8jw3-ccr9-xrmf
Author: Mike Bradeen
Date: 2026-03-30
To avoid a potential null dereference use the remote address
in error logging when there is no user or the user acl fails.
Resolves: #GHSA-3rhj-hhw7-m6fw
Author: Mike Bradeen
Date: 2026-03-31
Replace a call to vsprintf with a call to ast_vasprintf to
prevent a possible buffer overflow.
Resolves: #GHSA-x348-j6c9-77f3
Author: Pengpeng Hou
Date: 2026-04-01
The protocol 1 unpack helpers trusted externally controlled lengths and wrote
them directly into fixed-size buffers in sms_t. Clamp the address, header,
and body copies to the destination array sizes so malformed messages cannot
overwrite adjacent state.
Resolves: #GHSA-q9fr-m7g8-6ph5
Author: Milan Kyselica
Date: 2026-03-26
The snprintf size parameter in xmpp_action_hook() is computed from
the attacker-controlled namespace prefix length and is not bounded
by the 256-byte stack buffer size. When a remote XMPP peer sends a
stanza with a child element whose namespace prefix exceeds 249
characters, snprintf writes past the buffer boundary.
Use sizeof(attr) as the snprintf size limit and %.*s precision to
extract only the prefix portion of the element name, preserving
the original truncation behavior for valid inputs.
Resolves: #GHSA-mxgm-8c6f-5p8f
Author: Milan Kyselica
Date: 2026-03-24
The parse_simple_message_summary() function uses sscanf with an
unbounded %s format specifier to parse the Message-Account field
from incoming SIP NOTIFY bodies into a fixed-size 512-byte stack
buffer (PJSIP_MAX_URL_SIZE). A single unauthenticated SIP NOTIFY
with a Message-Account value exceeding 512 bytes overflows the
buffer, corrupting adjacent stack data and permanently disabling
the PJSIP transport layer without crashing the process.
Add a width specifier (%511s) to limit the sscanf write to
PJSIP_MAX_URL_SIZE - 1 bytes plus the NUL terminator, matching
the destination buffer size.
Resolves: #GHSA-589g-qgf8-m6mx
Author: Milan Kyselica
Date: 2026-03-23
The LDAP realtime driver constructs search filters by directly
concatenating user-supplied values without RFC 4515 escaping.
When LDAP is used as a realtime backend for endpoint
identification, characters with special meaning in LDAP filters
(*, (, ), ) can be injected via the SIP From header username.
Add ldap_filter_escape_value() that escapes RFC 4515 special
characters to their \HH hex representation, and apply it to
non-LIKE query values. The LIKE query path preserves the existing
wildcard conversion behavior with a note for maintainers.
Resolves: #GHSA-r6c2-hwc2-j4mp
Author: Milan Kyselica
Date: 2026-03-23
The eventtype column handler in cel_pgsql.c inserts
record.user_defined_name directly into the SQL query without
calling PQescapeStringConn(), while all other string fields in
the same function are properly escaped. Similarly, cel_tds.c
passes the raw user_defined_name into the SQL INSERT without
routing it through anti_injection(), while all other fields are
processed through that function.
For cel_pgsql.c, escape the eventtype value using
PQescapeStringConn(), matching the existing pattern used for all
other string fields at lines 308-331 of the same function.
For cel_tds.c, route the eventtype value through
anti_injection() consistent with how all other fields are handled
in the same function.
Resolves: #GHSA-ph27-3m5q-mj5m
Author: Milan Kyselica
Date: 2026-04-08
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.
Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.
Resolves: #GHSA-4pgv-j3mr-3rcp
Author: Milan Kyselica
Date: 2026-04-08
The codec2_samples() function uses floor division (160 * datalen/6)
to compute expected output samples, but the decode loop condition
(x < datalen) iterates with ceiling behavior when datalen is not a
multiple of CODEC2_FRAME_LEN. This mismatch causes the loop to
decode one extra frame beyond what the framework bounds check
budgeted for, leading to an out-of-bounds write on the output buffer.
Change the loop condition to only process complete frames, matching
the floor-division behavior of codec2_samples(). This also prevents
an out-of-bounds read on the input side when fewer than
CODEC2_FRAME_LEN bytes remain.
Resolves: #GHSA-qf8j-jp7h-c5hx
Author: Milan Kyselica
Date: 2026-03-23
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.
Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().
Resolves: #GHSA-8jhw-m2hg-vp3h
Author: Joshua C. Colp
Date: 2026-02-12
GCC 15.2.1 pays attention to the discarding of the const
qualifier when strchr, strrchr, memchr, or memrchr are now
used. This change fixes numerous errors with this throughout
the tree. The fixes can be broken down into the following:
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
AES-256-GCM and ChaCha20-Poly1305 for S/MIME (#161).allowInvalidCerts option to allow connecting to S3 endpoints with invalid TLS certificates.Principal/query returns broad results when a name or email filter cannot be resolved.
VIENNA, Austria – June 25, 2026 – Enterprise software developer Proxmox Server Solutions today announced that Zabbix LLC has joined the Proxmox partner ecosystem as an official Solution Provider. Through its official API-based integration, Zabbix 7.4 provides comprehensive monitoring and observability for organizations running mission-critical workloads on Proxmox Virtual Environment.
Zabbix monitors clusters, nodes, virtual machines, LXC containers, storage resources, mount points, and network interfaces. Automated problem detection and flexible alerting capabilities help administrators identify issues early and respond proactively to performance and availability risks.
Together, Proxmox VE and Zabbix support efficient day-to-day operations and reliable service delivery across a wide range of deployment scales.
"We're glad to offer Proxmox users deeper visibility into their virtualized environments. Our goal was to provide an at-a-glance view of infrastructure health and performance, combined with customizable alert thresholds to help teams detect issues early and maintain reliable operations”, said Marina Generalova, Integrations Delivery Manager of Zabbix
For more information about monitoring Proxmox Virtual Environment with Zabbix, please visit Zabbix integration page for Proxmox.
###
About Zabbix LLC
Zabbix 7.4 is an enterprise-class, open source distributed monitoring and observability solution designed to track the performance and availability of IT resources. Zabbix also provides commercial services such as technical support, integration, implementation, and customized development services as well as professional training and Zabbix Academy courses. The company’s newest solution, Zabbix Cloud, offers the entire range of Zabbix features with easier deployment and management, enhanced scalability, and automatic upgrades.
Learn more: https://www.zabbix.com
About Proxmox Server Solutions
Proxmox Server Solutions provides powerful, intuitive open-source server software that guarantees vendor independence and minimizes total cost of ownership. Enterprises of all sizes rely on the company’s reliable vendor support, certified training services, and a global network of 3,000 integration partners to ensure business continuity. Established in 2005 and headquartered in Vienna, Austria, tens of thousands of corporate customers worldwide trust Proxmox solutions to secure their mission-critical IT environments. To learn more visit https://www.proxmox.com or follow us on LinkedIn and YouTube.
Contact: Daniela Häsler, Proxmox Server Solutions GmbH, press@proxmox.com
njs-1.0.0 version has been released, deprecating the njs engine in favor of QuickJS, aligning exception classes between the engines, and hardening ngx.fetch() request validation.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
redirectRoot option to Http object to allow redirecting requests to the root path to a different path (e.g. /account).reuseKey option to allow reusing private keys in renewals.GETJMAPACCESS command to discover the JMAP session resource URL (#2736).using.application/json in the Content-Type header.accountId argument on requests.notFound / notUpdated / notDestroyed / notCopied instead of dropping them.*/set: Unchanged immutable id property is rejected on update.*/query and */queryChanges: nullrejected asnotRequest`.Email/query:
anchor handling.collapseThreads is enabled.hasKeyword, allInThreadHaveKeyword, and someInThreadHaveKeyword conditions.Email/copy: Take the source message id from the value's id property.Email/set: Bump reference-resolution max_depth from 1 to 2.Email/import: Reject blobs that do not contain valid messages.EmailSubmission/set: return sendAt and undoStatus in the created response.Mailbox/set: Return alreadyExists instead of invalidProperties when creating a mailbox with an existing name.SearchSnippet/get: incorrect response structure.Thread/changes: emit a container delete when a thread becomes empty.VacationResponse/set: incorrect singleton handling.TLSA record validation (#2328 - credits to @vdukhovni).include statements ignore capitalisation of sub-script names (#1643)
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.4.html]
This release addresses five low-impact problems that need to be addressed as they can reduce safety margins.
In addition to updated releases for the supported Postfix versions 3.8-3.11, patches will also be available at the Postfix source mirror sites for the out-of-support Postfix versions 2.9-3.7:
These patches come with the same PGP, GPG1 and GPG2 signatures as Postfix release tarballs and patches.
Fixed in Postfix 3.8-3.11:
Bug 1 (defect introduced: Postfix 3.1, date 20150607): null pointer read and heap data overread in the Postfix SMTP client's smtp_dns_reply_filter. Problem reported by TristanInSec, found with ASAN. Also reported by other people. Reproduction and real-world impact researched by Wietse.
Root cause for bug 1:
A missing 'break' statement after the code that converts a TLSA record to string.
Reproduction for bug 1:
The problem happens when smtp_dns_reply_filter is configured (this is disabled by default); the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); the destination domain publishes a TLSA record that is empty or shorter than 20 bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a zero-length TLSA record is blocked by BIND, Google DNS, OpenDNS, and by configurations that use systemd-resolved (the default on many LINUX systems); it is passed by Cloudflare, Quad9 DNS, and unbound, as long as these resolvers are used without systemd-resolved.
Impact statement for bug 1:
SMTP client termination with a null pointer read crash when the TLSA record length is zero; or an SMTP client data overread (or rarely, SMTP client termination with a read segfault crash) when 0 < record length < 20 bytes. The overread content is not disclosed.
Performance impact of bugs 1 and 2:
The impact of SMTP client crashes (voluntary or not) is easily overstated. That said, crashes must be eliminated regardless of their impact.
On systems that deliver fewer than one message per minute, an SMTP client crash can result in a delay of up to one minute for email delivery to other destination domains.
On systems with a larger traffic volume, the impact of an SMTP client crash on deliveries to other destination domains is minor because Postfix reuses SMTP client processes and replaces a failed process within seconds (self-healing); the practical impact is believed to be no worse than that of an uncooperative receiver that tarpits SMTP connections from Postfix to one or more destination domains under their control (by replying within Postfix SMTP client read time limits which are several minutes by default).
Bug 2 (defect introduced: Postfix 3.6, date: 20200710): panic (assertion failure and voluntary crash) while parsing a TLSA reply with length 3. Found during code maintenance. See below for root cause, reproduction, and impact.
Root cause for bug 2:
An incorrect test 'length < 3' instead of 'length <= 3' causes a safety check to fail when a TLSA parser attempts to create zero-length storage for a non-existent TLSA certificate association data field.
Reproduction for bug 2:
The problem happens when the Postfix SMTP client is configured to use opportunistic or mandatory DANE authentication (this is disabled by default); a destination domain publishes a TLSA record with a length of three bytes; and the OS is configured to use a resolver that passes such a TLSA record. For example, a length-three TLSA record is blocked by BIND, and by configurations that use systemd-resolved (the default on many LINUX systems). It is passed by many other resolvers.
Bug 2 enables an attack that is more potent than bug 1.
An attack with a length-three TLSA reply does not depend on smtp_dns_reply_filter configuration.
An attack with a length-three TLSA reply propagates through more resolvers than an attack with a length-zero TLSA reply.
Impact statement for bug 2:
SMTP client voluntary termination (crash) after an assertion failure. This is a fail-safe mechanism.
See also above for "Performance impact of bugs 1 and 2".
Bug 3 (Problem introduced: Postfix 2.9, date: 20110205) Robustness: the Postfix SMTP server will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP command line. Problem reported by Michael Wollner (Ibonok). Under high load conditions, the amount of text was already limited by a 10-second deadline to receive an SMTP command.
Bug 4 Robustness: with the above change the Postfix SMTP client will no longer receive (and discard) an unlimited amount of text while receiving a long SMTP response line.
Bug 5 (Problem introduced: Postfix 3.4, date: 20180825) Robustness: do not receive (and discard) unlimited amounts of data with BDAT commands. Problem found during code maintenance. File: smtpd/smtpd.c.
Impact statement for bugs 3, 4, 5:
Postfix should not receive and discard unlimited amounts of input in SMTP command lines or BDAT chunks, but fixing that will not fundamentally change the situation.
By design, any SMTP client can force a server to receive (and discard) an unlimited amount of text.
For example, an attacker can repeatedly send messages that are a little under the server's message size limit and abort each transaction a before reaching the message end. When sending a message with the "DATA" command, an attacker would disconnect instead of sending <CR><LF>.<CR><LF>; and when sending a message with the "BDAT" command, an attacker would send "RSET" instead of "BDAT LAST".
To mitigate such abuse, Postfix can rate-limit the number of message transactions from the same IP address or address range (see smtpd_client_message_rate_limit and *prefix_length parameters). Such a defense is ineffective when faced with a distributed attack (botnet); for that, postscreen combined with an IP reputation service (DNSBL) may be more effective.
You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.
nginx-1.30.3 stable and nginx-1.31.2 mainline versions have been released, with fixes for buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module (CVE-2026-42055), and buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-48142). Additionally, nginx-1.31.2 includes a fix for use-after-free vulnerability in the ngx_http_v3_module (CVE-2026-42530).
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
*/changes methods leak ids of non-shared objects (reported by @5ud0er).http_header function.default virtual queue.address-data are ignored.keep is not specified.
The Asterisk Development Team would like to announce
the release of asterisk-23.4.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.4.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The Asterisk Development Team would like to announce
the release of asterisk-22.10.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.10.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
The Asterisk Development Team would like to announce
the release of asterisk-20.20.0.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.0
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.20.0
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
VIENNA, Austria – June 11, 2026 – Enterprise software developer Proxmox Server Solutions today announced the release of Proxmox Mail Gateway 9.1. The updated version of its enterprise email security solution introduces updated core components, comprehensive usability improvements to the spam quarantine, and data encryption options for integrated backups.
Proxmox Mail Gateway functions as a full-featured mail proxy deployed between the firewall and internal mail servers. It filters all incoming and outgoing email traffic at the gateway, protecting organizations against threats such as spam, viruses, Trojans, and phishing attacks.
Updated core components
Built on Debian 13.5 “Trixie”, the platform includes updated underlying packages, utilizing a newer Linux kernel 7.0 as its stable default. Proxmox Mail Gateway 9.1 continues to align with the latest major enterprise open-source security components and incorporates stable versions of SpamAssassin 4.0.2 (with continuously updated rulesets), ClamAV 1.4.4, PostgreSQL 17, and ZFS 2.4.
Spam quarantine usability improvements
The web-based quarantine interface features several enhancements to optimize daily administrative and end-user workflows.
Encrypted Proxmox Backup Server targets
Version 9.1 adds native encryption support for backups targeted at a Proxmox Backup Server instance. This option ensures that sensitive email configuration settings, user created rule system data, and historic/private statistics data are encrypted client-side before transmission and remain encrypted at rest on the backup storage target.
Proxmox Mail Gateway 9.1 is open-source software and immediately available for download. Users can obtain a complete installation image via ISO download, which contains the full feature-set of the solution and can be installed quickly on bare-metal systems using an intuitive installation wizard. The software can be installed on top of an existing Debian installation or as a lightweight Linux Container (LXC) on Proxmox VE. A seamless, fully tested upgrade path from Proxmox Mail Gateway 8.2 or 9.0 is available via the APT package management system.
For production environments, Proxmox offers comprehensive enterprise support plans that provide stable and secure updates and direct access to expert support services. These support contracts offer a cost-effective way to secure enterprise-grade stability. Pricing start at EUR 190 per host per year, including unlimited users and domains.
Resources:
About Proxmox Mail Gateway
Proxmox Mail Gateway is the leading open-source email security solution, protecting your mail server against all email threats from the moment they emerge. Organizations of any size can easily deploy and implement the comprehensive anti-spam and antivirus platform in just a few minutes. Deploying the full-featured mail proxy between the firewall and an internal mail server allows you to control all incoming and outgoing email traffic from the central, web-based interface. Proxmox filters all email traffic at the gateway before it reaches the mail server, protecting businesses against email attacks and other malicious threats.
About Proxmox Server Solutions
Proxmox Server Solutions provides powerful, intuitive open-source server software that guarantees vendor independence and minimizes total cost of ownership. Enterprises of all sizes rely on the company’s reliable vendor support, certified training services, and a global network of 3,000 integration partners to ensure business continuity. Established in 2005 and headquartered in Vienna, Austria, tens of thousands of corporate customers worldwide trust Proxmox solutions to secure their mission-critical IT environments.
Contact: Daniela Häsler, Proxmox Server Solutions GmbH, press@proxmox.com
General
Media-over-QUIC
RTSP
RTMP
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
AES-256-GCM-SIV AEAD format that carries the account name for proxy routing.550 Mailbox not found.FileNode/get returns a stale state string.SieveSystemInterpreter.defaultReturnPath and MtaQueueQuota.match optional expressions.dns-update-v0.5.1.
