CVE-2022-42705: Sangoma Asterisk

Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days.

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.

Affected products

• Sangoma Asterisk: from 16.0.0, before 16.29.1 (fixed in 16.29.1); from 18.14.0, before 18.15.1 (fixed in 18.15.1); from 19.6.0, before 19.7.1 (fixed in 19.7.1); version 20.0.0 only
• Sangoma Certified Asterisk: version 18.9 only

Published 2022-12-05. Last modified 2026-06-17.