CVE-2011-4063: Asterisk Open Source

Medium severity, CVSS 6.8. EPSS: 2.4% chance of exploitation in the next 30 days.

chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request.

Affected products

• Asterisk Open Source: version 1.8.7 only; version 10.0.0 only

Published 2011-10-21. Last modified 2026-06-16.