CVE-2017-17850: Asterisk PJSIP missing Contact header crashes channel driver

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability and no required privileges or interaction, plus a very high EPSS score, makes this a serious availability risk despite the absence of KEV listing.

What it is

Asterisk versions 13.18.4, 14.7.4, 15.1.4 and 13.18-cert1 and older crash when a select set of SIP messages that must carry a Contact header arrive without one and the PJSIP channel driver is in use. The flaw is improper input validation (CWE-20) in dialog-creating SIP message handling, and it matters because a single malformed message can take down the telephony service.

Impact

An attacker can cause a denial of service by crashing Asterisk, disrupting calls and SIP services on the affected system. No confidentiality or integrity impact is described; only availability is affected.

Attack surface

The flaw is reachable over the network via SIP messages to the PJSIP channel driver, with no user interaction required. Authentication is not required by the CVSS vector, though the description notes that enabling authentication forces a user to be authorized before reaching the crash point.

Exploitation

The record shows no CISA KEV listing and no exploit references, but EPSS is very high at 0.75351 (99.5th percentile), indicating elevated predicted exploitation activity. No public exploit code or in-the-wild use is documented in the supplied references.

What to do

• Upgrade Asterisk to a release newer than 13.18.4, 14.7.4, 15.1.4 or 13.18-cert1 as fixed by the vendor advisory AST-2017-014.
• Enable SIP authentication so unauthenticated users cannot reach the crash point.
• Restrict SIP exposure to trusted networks or filter malformed SIP messages at the perimeter.
• Monitor the Asterisk project and Gentoo GLSA 201811-11 for further fixed versions if you run packaged builds.

Detection

• Monitor Asterisk logs and core dumps for crashes tied to PJSIP dialog creation or missing Contact headers.
• Alert on SIP messages that create dialogs without a Contact header reaching the PJSIP channel driver.
• Track service restarts or availability gaps in Asterisk to catch crash-induced outages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.