Debian bullseye
Source: Debian Security Tracker
asterisk→ fixed in1:16.28.0~dfsg-0+deb11u1urgency: not yet assignedsudo apt-get install --only-upgrade -y asterisk
Back to CVE digest
CVE-2022-26498 · cross-distro fix matrix
CVE-2022-26498: An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.
Affects 6 Linux releases across 6 (distro × package) combinations.
Fix per ecosystem
Each block below is a distro release where CVE-2022-26498 has a known fix. Run the listed command on that distro to remediate.
Alpine v3.20
Source: Alpine secdb
asterisk→ fixed in18.11.2-r0apk update && apk add --upgrade asterisk
Alpine v3.21
Source: Alpine secdb
asterisk→ fixed in18.11.2-r0apk update && apk add --upgrade asterisk
Alpine edge
Source: Alpine secdb
asterisk→ fixed in18.11.2-r0apk update && apk add --upgrade asterisk
Alpine v3.18
Source: Alpine secdb
asterisk→ fixed in18.11.2-r0apk update && apk add --upgrade asterisk
Alpine v3.19
Source: Alpine secdb
asterisk→ fixed in18.11.2-r0apk update && apk add --upgrade asterisk
Are YOU affected by CVE-2022-26498?
5-second check on your actual server. Reads /etc/os-release, uname -r, and the distro's package manager; matches against this same cross-source index live.
curl https://mindsparkstack.com/scan.sh | bash
Continuous monitoring beats manual checking
CVE-2022-26498dropped silently in your distro's update channel. Every new CVE is the same story. StackPatch runs the matcher hourly against all 5 sources and emails the exact remediation when something new applies to one of your servers. $99 lifetime, 50 founder seats, 30-day refund.
See StackPatch ($99 lifetime)