Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-57186EUVD-2026-111395GHSA-H5HV-JMGJ-92Q2

Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 21.12.3, 22.10.1, 23.4.1, 22.8-cert3
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

The chan_ooh323 channel driver, an optional add-on for the Asterisk open source telephony toolkit, is affected. Malformed Q.931 messages sent to it can crash Asterisk, causing a denial of service for systems that have this driver compiled and publicly reachable.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  4. Record last updated

Affected versions

  • asterisk asterisk

    From 21.0.0-pre1 · fixed in 21.12.3; From 22.0.0-pre1 · fixed in 22.10.1; From 23.0.0-pre1 · fixed in 23.4.1

  • asterisk certified-asterisk

    From 22.8-cert1-pre1 · fixed in 22.8-cert3

References 11

GitHub · asterisk/asterisk