CVE-2026-57185 Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

CVE-2026-57185

Asterisk, an open-source telephony toolkit, is vulnerable to a buffer over-read in the PJSIP MWI body parser . An authenticated attacker can crash the service by sending a specially crafted SIP NOTIFY request. To exploit this, the attacker must first pass SIP authentication via username/password ...

CVE-2026-57185 Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

CVE-2026-57185

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the "PJSIP MWI body parser" by sending a careful...

EUVD-2026-111103

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

body-parser: body-parser: Denial of Service via unhandled decompression stream error

A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the...

CLSA-2026-1793099858 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.6-tuxcare.1...

CLSA-2026-1793098724 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.3-tuxcare.3...

CLSA-2026-1793098695 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.5-tuxcare.3...

CLSA-2026-1793098476 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.4-tuxcare.2...

CLSA-2026-1793097203 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.8.4-tuxcare.4...

Asterisk buffer error vulnerability

Versions prior to Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3 are affected by a buffer error vulnerability. This vulnerability stems from an excessive read of the PJSIP MWI body parser buffer. Authenticated attackers c...

CVE-2026-57185: Buffer Over-read

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

PT-2026-126692

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

body-parser: body-parser: Denial of Service via unhandled decompression stream error

A flaw was found in body-parser. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted HTTP request with compressed content containing unexpected trailing data. Because the application fails to handle decompression stream errors after processing the...

Exploit for CVE-2026-111497

node2shell-detector Host-side detections for Node2Shell CV...

Body-parser Vulnerable To Denial Of Service Via Trailing Bytes After A Compressed Request Body

Impact A single request can crash any application using "body-parser" with default options. When a request carries a "Content-Encoding" for example "gzip", "body-parser" pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of...

SUSE CVE-2026-111181

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

npm: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

npm: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body vulnerability discovered by ? in WordPress npm body-parser versions 1.20.9...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +19014 more potentially affected by CVE-2026-111181 via body-parser (>=1.0.0, <=1.20.8)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.2.0 and more Source cves: CVE-2026-111181 Source advisory: GHSA-27R3-JXMH-P828...