CVE-2013-2686: main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x...

Security readout for executives and security teams

CVE-2013-2686 is a denial-of-service flaw in older Asterisk HTTP server code. A remote attacker could send a crafted HTTP POST request that consumes stack space and crashes the Asterisk daemon, interrupting telephony or related services exposed through Asterisk HTTP features. Exposure is most likely where affected Asterisk HTTP server functionality is enabled and reachable by untrusted networks. Internet-facing PBX management or phone integration endpoints would carry higher operational risk than tightly firewalled internal deployments. Treat this as an operational availability issue. It is not described as data theft or code execution, but a crash in production Asterisk can disrupt business voice services. Prioritize exposed or business-critical PBX systems still running affected legacy versions. Mitigation focus: Upgrade Asterisk to the fixed version for the deployed branch.; Review AST-2013-002 for vendor-specific remediation guidance.; Restrict Asterisk HTTP access to trusted administration networks..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.