Is CVE-2009-2726 being actively exploited?

CVE-2009-2726 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-2726?

CVE-2009-2726 has a CVSS 2.0 base score of 7.8 (HIGH).

CVE-2009-2726

HIGH · CVSS 7.8EPSS 6.5%EU EUVD

The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.

Key facts

CVSS score: 7.8 (v2.0)
Severity: HIGH
CVSS vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness (CWE): CWE-770
EPSS score: 6.5% (94th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-2717)
Published: August 12, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-2717 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

digium / asterisk
digium / asterisk
digium / s800i
digium / s800i firmware

References

http://downloads.digium.com/pub/security/AST-2009-005.html(Product)
http://labs.mudynamics.com/advisories/MU-200908-01.txt(Broken Link)
http://secunia.com/advisories/36227(Broken Link, Vendor Advisory)
http://www.securityfocus.com/archive/1/505669/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/36015(Broken Link, Exploit, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1022705(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2009/2229(Broken Link, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain