DEBIAN-CVE-2026-57186: High severity debian/asterisk vulnerability

Q: Which deployments are realistically exposed?

Deployments are exposed only if the chan_ooh323 addon channel driver was explicitly compiled and installed, and its port is publicly reachable. The driver is not installed by default.

Q: What does an attacker need to do to trigger the issue?

An unauthenticated attacker needs network access to the publicly reachable chan_ooh323 port and can send an OOH323 request containing malformed Q.931 elements. Successful exploitation can crash Asterisk, causing denial of service.

Q: Which versions contain the fix?

The issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3. The affected range is versions greater than 20 before those fixes.

Q: What can be done if upgrading is not immediately possible?

Disable or remove the explicitly installed chan_ooh323 driver if it is not required. If it must remain enabled, ensure its port is not publicly reachable to reduce exposure.

Published Oct 27, 2026

Updated

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chanooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Affected Software

1 affected componentFixes available

debian/asterisk<1:22.10.1+dfsg+~cs6.17.60671434-1

1:22.10.1+dfsg+~cs6.17.60671434-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/asterisk to a version that resolves this vulnerability.
Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 21.12.3
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 22.10.1
Upgrade
Upgrade Asterisk to a version that resolves this vulnerability.
Fixed in 23.4.1
Upgrade
Upgrade Certified Asterisk to a version that resolves this vulnerability.
Fixed in 22.8-cert3

Event History

Oct 27, 2026

CVE Published

via OSV·10:17 PM

Data Sourced

via OSV·10:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Deployments are exposed only if the chan_ooh323 addon channel driver was explicitly compiled and installed, and its port is publicly reachable. The driver is not installed by default.

What does an attacker need to do to trigger the issue?

An unauthenticated attacker needs network access to the publicly reachable chan_ooh323 port and can send an OOH323 request containing malformed Q.931 elements. Successful exploitation can crash Asterisk, causing denial of service.

Which versions contain the fix?

The issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3. The affected range is versions greater than 20 before those fixes.

What can be done if upgrading is not immediately possible?

Disable or remove the explicitly installed chan_ooh323 driver if it is not required. If it must remain enabled, ensure its port is not publicly reachable to reduce exposure.

DEBIAN-CVE-2026-57186: High severity debian/asterisk vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to trigger the issue?

Which versions contain the fix?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What does an attacker need to do to trigger the issue?

Which versions contain the fix?

What can be done if upgrading is not immediately possible?