CVE-2026-23739: 
NixOS vulnerability analysis and mitigation

CVE-2026-23739 is an XML External Entity (XXE) injection vulnerability in Asterisk, the open-source PBX and telephony toolkit developed by Sangoma. The ast_xml_open() function in xml.c invokes xmlReadFile() with the unsafe XML_PARSE_NOENT flag and subsequently calls xmlXIncludeProcess(), enabling entity expansion and XInclude processing on untrusted XML input. Affected versions include Asterisk prior to 20.18.2, 21.12.1, 22.8.2, and 23.2.2, as well as Certified Asterisk prior to 20.7-cert9. The vulnerability was published on February 6, 2026, with patches released the same day. NVD assigns a CVSS v3.1 score of 6.5 (Medium), while the GitHub Security Advisory rates it as Low (2.0) due to the high privilege and user interaction requirements in current Asterisk deployments (GitHub Advisory, Red Hat CVE).

The root cause is CWE-611 (Improper Restriction of XML External Entity Reference). The ast_xml_open() function in xml.c passes the XML_PARSE_NOENT flag to libxml2's xmlReadFile(), which instructs the library to resolve and expand XML external entities — a feature disabled by default in libxml2 since version 2.9 due to well-known security risks. A subsequent call to xmlXIncludeProcess() further enables XInclude-based file inclusion. If an attacker can supply or influence an XML file parsed by this function (e.g., through user-controllable XML input that triggers Asterisk to parse it), they can craft a malicious XML document referencing local file paths via external entity declarations or XInclude directives, causing the server to read and potentially disclose those files. The advisory notes that Asterisk does not currently expose this function to untrusted input directly, but the fix was applied proactively (GitHub Advisory).

Successful exploitation results in local file disclosure from the host system running Asterisk, with high confidentiality impact (CVSS C:H per NVD scoring). An attacker could read sensitive files such as /etc/passwd, private keys, configuration files containing credentials, or other data accessible to the Asterisk process user. There is no integrity or availability impact identified. The scope is limited to the host system (no scope change), and lateral movement potential depends on the sensitivity of disclosed files (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.105%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and user interaction under current Asterisk configurations, significantly limiting practical attack surface.

Upgrade Asterisk to one of the patched versions: 20.18.2 (20.x branch), 21.12.1 (21.x branch), 22.8.2 (22.x branch), 23.2.2 (23.x branch), or Certified Asterisk 20.7-cert9. As a defense-in-depth measure, restrict user ability to supply XML input to the Asterisk process, implement input validation for any XML processed by Asterisk, and consider disabling XXE processing at the libxml2 library level if configurable. Running Asterisk under a least-privilege service account also limits the impact of any file disclosure (GitHub Advisory). Debian LTS users should apply the update announced via the debian-lts-announce mailing list (Debian LTS).

The vulnerability was credited to researcher "ThatTotallyRealMyth" and published by Asterisk maintainer gtjoseph via GitHub Security Advisories. Red Hat tracked the issue for its products. No significant broader media coverage or notable community debate has been observed, consistent with the low severity rating and absence of active exploitation (GitHub Advisory, Red Hat CVE).