DEBIAN-CVE-2026-57184: Medium severity debian/asterisk vulnerability

Q: Which deployments are exposed to this issue?

Exposure requires the chan_ooh323 addon channel driver to be explicitly compiled and installed, since it is not enabled by default. The port used by that driver must also be publicly reachable for an unauthenticated remote attacker to target it.

Q: What does an attacker need to exploit the vulnerability?

An attacker does not need authentication, but must be able to send carefully crafted Q.931 setup packets to the reachable chan_ooh323 service port. Successful exploitation may crash Asterisk through an out-of-bounds read.

Q: What can be done if an immediate upgrade is not possible?

Restrict public network access to the chan_ooh323 port, or disable/remove the chan_ooh323 addon channel driver if it is not required. These measures address the stated remote attack path.

Q: Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

Published Oct 26, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chanooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk 20 to a version that resolves this vulnerability.
Fixed in 20.20.1
Upgrade
Upgrade Asterisk 21 to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk 22 to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk 23 to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk 20 to a version that resolves this vulnerability.
Fixed in 20.7-cert11
Upgrade
Upgrade Certified Asterisk 22 to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 26, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Exposure requires the chan_ooh323 addon channel driver to be explicitly compiled and installed, since it is not enabled by default. The port used by that driver must also be publicly reachable for an unauthenticated remote attacker to target it.

What does an attacker need to exploit the vulnerability?

An attacker does not need authentication, but must be able to send carefully crafted Q.931 setup packets to the reachable chan_ooh323 service port. Successful exploitation may crash Asterisk through an out-of-bounds read.

What can be done if an immediate upgrade is not possible?

Restrict public network access to the chan_ooh323 port, or disable/remove the chan_ooh323 addon channel driver if it is not required. These measures address the stated remote attack path.

Which releases contain the fix?

The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.

DEBIAN-CVE-2026-57184: Medium severity debian/asterisk vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done if an immediate upgrade is not possible?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What can be done if an immediate upgrade is not possible?

Which releases contain the fix?