# CVE-2025-47779: Using malformed From header can forge identity with ";" or NULL in name portion

> Authenticated attackers can spoof user identities in SIP MESSAGE requests to send spam and facilitate social engineering attacks.

- **Severity:** High 7.7 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 22 May 2025
- **Updated:** 3 Nov 2025
- **Also known as:** DEBIAN-CVE-2025-47779, GHSA-2grh-7mhv-fcfw, UBUNTU-CVE-2025-47779

## What is CVE-2025-47779?

CVE-2025-47779 is a high-severity vulnerability in asterisk, published on 22 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.

Weakness: CWE-792 (Incomplete Filtering of One or More Instances of Special Elements), CWE-140 (Improper Neutralization of Delimiters)

## Which versions are affected by CVE-2025-47779?

It affects 2 products.


Products: Sangoma Asterisk, Sangoma Certified Asterisk.

## How do I fix CVE-2025-47779?

Upgrade to a fixed version.

## Is CVE-2025-47779 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47779 exists.

## Other vulnerabilities in asterisk

- [CVE-2024-57520](https://insights.sbomify.com/CVE-2024-57520/): Path traversal in n/a (critical 9.8)
- [CVE-2025-57767](https://insights.sbomify.com/CVE-2025-57767/): Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request (high 7.5)
- [CVE-2022-37325](https://insights.sbomify.com/CVE-2022-37325/): Memory corruption in n/a (high 7.5)
- [CVE-2025-1131](https://insights.sbomify.com/CVE-2025-1131/): Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation (high 7.0)
- [CVE-2025-54995](https://insights.sbomify.com/CVE-2025-54995/): Asterisk remotely exploitable leak of RTP UDP ports and internal resources (medium 6.5)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-47779 and fix it if it is affected.

What it is: CVE-2025-47779 is a high-severity vulnerability in asterisk, published on 22 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47779 exists.

Affected product: asterisk. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-47779/ (Markdown: https://insights.sbomify.com/CVE-2025-47779/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-47779
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-47779
- OSV: https://osv.dev/vulnerability/CVE-2025-47779

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-47779/
Summaries are generated and may contain mistakes; the official description above is the record.