Read the docs
TI-2026-81562 Aliases CVE-2026-57186

Asterisk chan_ooh323 Q.931 parser missing prior fix allows crash

Priority MEDIUM 40CWE-839Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The chan_ooh323 Q.931 party-number parser in Asterisk lacks the CVE-2022-37325 fix, which was never forward-ported from Asterisk 20. Malformed Q.931 elements in an OOH323 request can crash Asterisk. The chan_ooh323 addon must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. The CVSS 3.1 base score is 7.5 (HIGH), and the affected versions run from 21.0.0-pre1 until 21.12.3, 22.10.1 and 23.4.1, plus Certified Asterisk from 22.8-cert1-pre1 until 22.8-cert3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 21.12.3, 22.10.1, 23.4.1certified-asterisk (asterisk): 22.8-cert3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasterisk21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.121.12.3, 22.10.1, 23.4.1Patch availableCNA
asteriskcertified-asterisk22.8-cert1-pre1 to before 22.8-cert322.8-cert3Patch availableCNA
  • asterisk Vendorasterisk Affected 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 21.12.3, 22.10.1, 23.4.1 Patch available CNA
  • certified-asterisk Vendorasterisk Affected 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 22.8-cert3 Patch available CNA

Remediation

Upgrade to Asterisk 21.12.3, 22.10.1, 23.4.1 or Certified Asterisk 22.8-cert3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA asterisk (asterisk) Fixed in 21.12.3, 22.10.1, 23.4.1
  • Fix · CNA certified-asterisk (asterisk) Fixed in 22.8-cert3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-57186
  2. 2026-10-28 CISA SSVC decision points changed
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-10-28 Priority changed: LOW → MEDIUM
  5. 2026-11-02 Affected versions changed · Red Hat
  6. 2026-11-02 CVSS score added · Red Hat

References

Other 11

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences