CVE-2014-2286 — main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers

Back Back to CVE browser

HIGH

main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers

Published Apr 18, 2014

7.5

HIGH

CVSS 2.0

EPSS 16.39%

Description

main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.

Affected products

Remediation

No remediation recorded yet.

Metrics

16.39% 0.16390

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.16390

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	16.39% (0.16390)	96.88th	v5 (v2026.06.15)
Jun 15, 2026	16.26% (0.16262)	96.53th	v5 (v2026.06.15)
Dec 2, 2025	14.76% (0.14756)	94.27th	v4 (v2025.03.14)
Mar 30, 2025	46.21% (0.46214)	97.39th	v4 (v2025.03.14)
Mar 29, 2025	52.59% (0.52590)	96.99th	v4 (v2025.03.14)
Mar 17, 2025	46.21% (0.46214)	97.36th	v4 (v2025.03.14)
Dec 17, 2024	61.02% (0.61022)	97.94th	v3 (v2023.03.01)
Apr 16, 2024	59.87% (0.59869)	97.72th	v3 (v2023.03.01)
Nov 29, 2023	66.67% (0.66670)	97.61th	v3 (v2023.03.01)
Oct 13, 2023	72.63% (0.72633)	97.71th	v3 (v2023.03.01)
Aug 23, 2023	89.88% (0.89877)	98.35th	v3 (v2023.03.01)
Mar 7, 2023	92.80% (0.92795)	98.42th	v3 (v2023.03.01)
Mar 6, 2023	5.14% (0.05139)	89.65th	v2 (v2022.01.01)
Apr 1, 2022	5.14% (0.05139)	88.62th	v2 (v2022.01.01)
Feb 4, 2022	5.14% (0.05139)	75.16th	v2 (v2022.01.01)

Weaknesses (1)

CWE-20

Improper Input Validation

References (7)

http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff
x_refsource_MISCPatch
http://downloads.asterisk.org/pub/security/AST-2014-001.html
x_refsource_CONFIRMPatchVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
vendor-advisoryx_refsource_FEDORA
http://www.mandriva.com/security/advisories?name=MDVSA-2014:078
vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/66093
vdb-entryx_refsource_BID
https://issues.asterisk.org/jira/browse/ASTERISK-23340
x_refsource_CONFIRM

Link	Providers	Tags
http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff		x_refsource_MISCPatch
http://downloads.asterisk.org/pub/security/AST-2014-001.html		x_refsource_CONFIRMPatchVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html		vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html		vendor-advisoryx_refsource_FEDORA
http://www.mandriva.com/security/advisories?name=MDVSA-2014:078		vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/66093		vdb-entryx_refsource_BID
https://issues.asterisk.org/jira/browse/ASTERISK-23340		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 18, 2014

Updated Aug 6, 2024

Reserved Mar 5, 2014

Link CVE-2014-2286

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-2286

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-2286