Read the docs
TI-2018-12332 Aliases CVE-2018-17281GHSA-64m8-fx32-3864

There is a stack consumption vulnerability in the res_http_websocket.so module of…

Priority HIGH 65CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Why it matters now

EPSS 0.52449 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:digium:asterisk:*:*:*:*:lts:*:*:*13.0.0 – 13.23.0VulnerableDigium
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*14.0.0 – 14.7.7VulnerableDigium
cpe:2.3:a:digium:asterisk:*:*:*:*:standard:*:*:*15.0.0 – 15.6.0VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:lts:*:*:*11.6 cert12VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:lts:*:*:*11.6 cert13VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:lts:*:*:*11.6 cert14VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:lts:*:*:*11.6 cert15VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert16:*:*:lts:*:*:*11.6 cert16VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert17:*:*:lts:*:*:*11.6 cert17VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:11.6:cert18:*:*:lts:*:*:*11.6 cert18VulnerableDigium
  • cpe:2.3:a:digium:asterisk:*:*:*:*:lts:*:*:* Versions 13.0.0 – 13.23.0 Vulnerable ·Digium
  • cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* Versions 14.0.0 – 14.7.7 Vulnerable ·Digium
  • cpe:2.3:a:digium:asterisk:*:*:*:*:standard:*:*:* Versions 15.0.0 – 15.6.0 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:lts:*:*:* Versions 11.6 cert12 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:lts:*:*:* Versions 11.6 cert13 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:lts:*:*:* Versions 11.6 cert14 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:lts:*:*:* Versions 11.6 cert15 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert16:*:*:lts:*:*:* Versions 11.6 cert16 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert17:*:*:lts:*:*:* Versions 11.6 cert17 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:11.6:cert18:*:*:lts:*:*:* Versions 11.6 cert18 Vulnerable ·Digium
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:digium:certified_asterisk:13.1:cert3:*:*:lts:*:*:*13.1 cert3VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.1:cert4:*:*:lts:*:*:*13.1 cert4VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.1:cert5:*:*:lts:*:*:*13.1 cert5VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.1:cert6:*:*:lts:*:*:*13.1 cert6VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.1:cert7:*:*:lts:*:*:*13.1 cert7VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.1:cert8:*:*:lts:*:*:*13.1 cert8VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.8:cert1:*:*:lts:*:*:*13.8 cert1VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.8:cert2:*:*:lts:*:*:*13.8 cert2VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.8:cert3:*:*:lts:*:*:*13.8 cert3VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.8:cert4:*:*:lts:*:*:*13.8 cert4VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert1:*:*:lts:*:*:*13.13 cert1VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:lts:*:*:*13.13 cert2VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert3:*:*:lts:*:*:*13.13 cert3VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert4:*:*:lts:*:*:*13.13 cert4VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert5:*:*:lts:*:*:*13.13 cert5VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert6:*:*:lts:*:*:*13.13 cert6VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert7:*:*:lts:*:*:*13.13 cert7VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert8:*:*:lts:*:*:*13.13 cert8VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.13:cert9:*:*:lts:*:*:*13.13 cert9VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.21:cert1:*:*:lts:*:*:*13.21 cert1VulnerableDigium
cpe:2.3:a:digium:certified_asterisk:13.21:cert2:*:*:lts:*:*:*13.21 cert2VulnerableDigium
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert3:*:*:lts:*:*:* Versions 13.1 cert3 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert4:*:*:lts:*:*:* Versions 13.1 cert4 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert5:*:*:lts:*:*:* Versions 13.1 cert5 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert6:*:*:lts:*:*:* Versions 13.1 cert6 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert7:*:*:lts:*:*:* Versions 13.1 cert7 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.1:cert8:*:*:lts:*:*:* Versions 13.1 cert8 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.8:cert1:*:*:lts:*:*:* Versions 13.8 cert1 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.8:cert2:*:*:lts:*:*:* Versions 13.8 cert2 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.8:cert3:*:*:lts:*:*:* Versions 13.8 cert3 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.8:cert4:*:*:lts:*:*:* Versions 13.8 cert4 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert1:*:*:lts:*:*:* Versions 13.13 cert1 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:lts:*:*:* Versions 13.13 cert2 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert3:*:*:lts:*:*:* Versions 13.13 cert3 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert4:*:*:lts:*:*:* Versions 13.13 cert4 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert5:*:*:lts:*:*:* Versions 13.13 cert5 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert6:*:*:lts:*:*:* Versions 13.13 cert6 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert7:*:*:lts:*:*:* Versions 13.13 cert7 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert8:*:*:lts:*:*:* Versions 13.13 cert8 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.13:cert9:*:*:lts:*:*:* Versions 13.13 cert9 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.21:cert1:*:*:lts:*:*:* Versions 13.21 cert1 Vulnerable ·Digium
  • cpe:2.3:a:digium:certified_asterisk:13.21:cert2:*:*:lts:*:*:* Versions 13.21 cert2 Vulnerable ·Digium
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-17281
  2. 2026-10-03 Alias added: GHSA-64m8-fx32-3864

References

Patch 3

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences