CVE-2021-26906

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

• CWE-404

• http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AST-2021-005.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Feb/61Mailing List, Patch, Third Party Advisory
• https://downloads.asterisk.org/pub/security/Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2021-005.htmlVendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-29196Issue Tracking, Patch, Vendor Advisory
• http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AST-2021-005.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Feb/61Mailing List, Patch, Third Party Advisory
• https://downloads.asterisk.org/pub/security/Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2021-005.htmlVendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-29196Issue Tracking, Patch, Vendor Advisory

Published

Feb 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26900Windows Win32k Elevation of Privilege Vulnerability7.8
• CVE-2021-26901Windows Event Tracing Elevation of Privilege Vulnerability7.8
• CVE-2021-26902HEVC Video Extensions Remote Code Execution Vulnerability7.8
• CVE-2021-26903LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text…6.1
• CVE-2021-26904LMA ISIDA Retriever 5.2 allows SQL Injection.9.8
• CVE-2021-269051Password SCIM Bridge before 1.6.2 mishandles validation of …6.5
• CVE-2021-26908Automox Agent prior to version 31 logs potentially sensitive…3.3
• CVE-2021-26909Automox Agent prior to version 31 uses an insufficiently pro…5.3
• CVE-2021-26910Firejail before 0.9.64.4 allows attackers to bypass intended…7
• CVE-2021-26911core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has M…7.4
• CVE-2021-26912NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1
• CVE-2021-26913NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1