{"id":"UBUNTU-CVE-2021-26713","details":"A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.","modified":"2026-05-20T16:04:51.455730575Z","published":"2021-02-19T20:15:00Z","upstream":["CVE-2021-26713"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26713"},{"type":"REPORT","url":"https://downloads.asterisk.org/pub/security/"},{"type":"REPORT","url":"https://downloads.asterisk.org/pub/security/AST-2021-004.html"},{"type":"REPORT","url":"https://issues.asterisk.org/jira/browse/ASTERISK-29205"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-26713"}],"affected":[{"package":{"name":"asterisk","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.16.1~dfsg-2","1:16.16.1~dfsg-4","1:16.16.1~dfsg-4build1","1:16.16.1~dfsg+~2.10-1","1:18.10.0~dfsg+~cs6.10.40431411-2"],"ecosystem_specific":{"binaries":[{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk"},{"binary_name":"asterisk-config","binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2"},{"binary_name":"asterisk-dahdi","binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2"},{"binary_name":"asterisk-mobile","binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-modules"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mp3"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-mysql"},{"binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2","binary_name":"asterisk-ooh323"},{"binary_name":"asterisk-tests","binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2"},{"binary_name":"asterisk-vpb","binary_version":"1:18.10.0~dfsg+~cs6.10.40431411-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26713.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20.4.0~dfsg+~cs6.13.40431414-2","1:20.5.0~dfsg+~cs6.13.40431414-1","1:20.5.1~dfsg+~cs6.13.40431414-1","1:20.5.2~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-1","1:20.6.0~dfsg+~cs6.13.40431414-2","1:20.6.0~dfsg+~cs6.13.40431414-2build3","1:20.6.0~dfsg+~cs6.13.40431414-2build4","1:20.6.0~dfsg+~cs6.13.40431414-2build5"],"ecosystem_specific":{"binaries":[{"binary_name":"asterisk","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_name":"asterisk-config","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_name":"asterisk-dahdi","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-mobile"},{"binary_name":"asterisk-modules","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_name":"asterisk-mp3","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_name":"asterisk-mysql","binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-ooh323"},{"binary_version":"1:20.6.0~dfsg+~cs6.13.40431414-2build5","binary_name":"asterisk-tests"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26713.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.2.0~dfsg+~cs6.15.60671435-2","1:22.3.0~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-1","1:22.4.1~dfsg+~cs6.15.60671435-2","1:22.5.1~dfsg+~cs6.15.60671435-1","1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_name":"asterisk","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-config","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-dahdi"},{"binary_name":"asterisk-mobile","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-modules","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-mp3"},{"binary_name":"asterisk-mysql","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-ooh323","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-tests","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26713.json"}},{"package":{"name":"asterisk","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/asterisk?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:22.5.2~dfsg+~cs6.15.60671435-1"],"ecosystem_specific":{"binaries":[{"binary_name":"asterisk","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-config"},{"binary_name":"asterisk-dahdi","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-mobile","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-modules","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-mp3","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_name":"asterisk-mysql","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"},{"binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1","binary_name":"asterisk-ooh323"},{"binary_name":"asterisk-tests","binary_version":"1:22.5.2~dfsg+~cs6.15.60671435-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26713.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}