CVE-2022-26498

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

• CWE-400

• http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.htmlPatch, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
• https://downloads.asterisk.org/pub/security/Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2022-001.htmlPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory
• http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.htmlPatch, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html
• https://downloads.asterisk.org/pub/security/Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2022-001.htmlPatch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5285Third Party Advisory

Published

Apr 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26491An issue was discovered in Pidgin before 2.14.9. A remote at…5.9
• CVE-2022-26493Xecurify's miniOrange Premium, Standard, and Enterprise Drup…8.8
• CVE-2022-26494An XSS was identified in the Admin Web interface of PrimeKey…4.8
• CVE-2022-26495In nbd-server in nbd before 3.24, there is an integer overfl…9.8
• CVE-2022-26496In nbd-server in nbd before 3.24, there is a stack-based buf…9.8
• CVE-2022-26497BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor c…5.4
• CVE-2022-26499An SSRF issue was discovered in Asterisk through 19.x. When …9.1
• CVE-2022-2650Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2022-26500Improper limitation of path names in Veeam Backup & Replicat…8.8
• CVE-2022-26501Veeam Backup & Replication 10.x and 11.x has Incorrect Acces…9.8
• CVE-2022-26502Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-26503Deserialization of untrusted data in Veeam Agent for Windows…7.8