CVE-2014-2289: Digium Asterisk

Low severity, CVSS 3.5. EPSS: 2.2% chance of exploitation in the next 30 days.

res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.

Affected products

• Digium Asterisk: version 12.0.0 only; version 12.1.0 only

Published 2014-04-18. Last modified 2026-06-17.