A null pointer dereference in the Asterisk Manager Interface (AMI) when Digest Authentication is used over HTTP can be triggered by an unauthenticated attacker who sends a tailored HTTP request. The flaw causes the core to crash, resulting in a denial of service that affects all functions of the Asterisk instance. This weakness is identified as CWE-476 and is a classic example of an improper null pointer dereference leading to application instability.

The vulnerability affects the asterisk:asterisk and asterisk:certified-asterisk families, specifically the pre‑20.20.1, pre‑21.12.3, pre‑22.10.1, pre‑23.4.1 releases and the Certified 20.7‑cert11, 22.8‑cert3 builds, any configuration in which the HTTP web server, AMI or HTTP‑based AMI access is enabled. All three components are disabled by default; when enabled the HTTP server binds only to 127.0.0.1 unless the administrator changes the listen interface.

The CVSS score of 7.5 indicates a reasonably high severity, and the EPSS score is unavailable, suggesting no recorded exploitation data yet. The vulnerability is not listed in CISA KEV catalog. The likely attack vector is local since the HTTP interface defaults to localhost, but it could be exposed to external hosts if the configuration is altered. An attacker only needs to reach the HTTP endpoint, send an HTTP request with Digest Authentication headers, and the server will dereference a null pointer, causing a crash.