CVE-2017-14098: Asterisk res_pjsip tel URI parsing crash in SIP headers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote input can crash a core telephony service, and the high EPSS score indicates elevated exploitation likelihood despite no KEV listing.

What it is

Asterisk's pjsip channel driver (res_pjsip) fails to properly validate a crafted tel URI placed in a From, To, or Contact header, causing the process to crash. The flaw affects Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, and because the malformed header arrives over the network without authentication, it can take down a SIP service.

Impact

An attacker can cause a denial of service by crashing the Asterisk process, interrupting voice services for all users on the affected system. No data confidentiality or integrity impact is described; the effect is availability loss only.

Attack surface

The flaw is reached remotely over the network via SIP messages containing a crafted tel URI in a From, To, or Contact header. The CVSS vector indicates no privileges and no user interaction are required, so an unauthenticated sender can trigger it.

Exploitation

CVE-2017-14098 is not listed in CISA KEV, but EPSS is high at roughly 0.50 probability (98.8th percentile), suggesting meaningful likelihood of exploitation activity. References are vendor advisories, patch notes, and issue trackers; none are tagged as exploit code.

What to do

• Upgrade Asterisk to 13.17.1 or 14.6.1 or later, per vendor advisory AST-2017-007.
• If immediate upgrade is not possible, restrict SIP exposure to trusted networks and block untrusted sources at the firewall.
• Apply vendor or distribution patches (for example the Debian fix referenced in the advisory) where packaged versions are used.
• Monitor and rate-limit SIP traffic to reduce the chance of repeated crash attempts against the service.

Detection

• Watch for Asterisk process restarts or core dumps correlated with inbound SIP messages.
• Inspect SIP From, To, and Contact headers for malformed or unusual tel URIs.
• Alert on repeated SIP requests from a single source that precede service interruptions.
• Review Asterisk logs and security advisories for crash signatures tied to res_pjsip header parsing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.