CVE-2026-57186: Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chanooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments running affected Asterisk versions greater than 20 are exposed only if the chan_ooh323 addon channel driver has been explicitly compiled and installed and its port is publicly reachable. The driver is not installed by default.
What does an attacker need to do to trigger the crash?
An unauthenticated attacker needs network access to the publicly reachable chan_ooh323 port and can send an OOH323 request containing malformed Q.931 elements. No user interaction or prior privileges are required.
Which releases contain the fix?
The issue is fixed in Asterisk 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 22.8-cert3.
What can be done if an upgrade cannot be applied immediately?
Reduce exposure by ensuring the chan_ooh323 port is not publicly reachable. If chan_ooh323 is not required, do not compile or install the addon channel driver.