{"id":"CVE-2026-57184","kind":"vulnerability","aliases":["CVE-2026-57184"],"related":[],"title":"Asterisk: crafted H.323 setup packet crashes server via chan_ooh323","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"An out-of-bounds read in the Q.931 information-element parser of Asterisk's chan_ooh323 H.323 channel driver lets an unauthenticated remote attacker crash Asterisk with crafted setup packets. The impact is denial of service, not code execution, as far as the sources state.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","package","self-hosted","telephony","voip"],"not_affected_if":["chan_ooh323-not-installed","default-config","h323-port-not-public"],"how_to_check":"- Run `asterisk -rx \"module show like ooh323\"` to see whether chan_ooh323 is loaded\n- Check for chan_ooh323.so in the Asterisk modules directory (`ls /usr/lib/asterisk/modules | grep ooh323`)\n- Confirm the H.323 listener port is reachable from the internet","fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`\n- If chan_ooh323 is not needed, remove or unload it and block the H.323 port at the firewall","status":"open","published_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:47+00:00","updated_at":"2026-10-26T20:51:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T20:51:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`\n- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`\n- If chan_ooh323 is not needed, remove or unload it and block the H.323 port at the firewall","reach":"internet","title":"Asterisk: crafted H.323 setup packet crashes server via chan_ooh323","impact":"low","summary":"An out-of-bounds read in the Q.931 information-element parser of Asterisk's chan_ooh323 H.323 channel driver lets an unauthenticated remote attacker crash Asterisk with crafted setup packets. The impact is denial of service, not code execution, as far as the sources state.","category":"package","nicknames":[],"who_cares":["asterisk","telephony","voip","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Asterisk process crashes, interrupting phone service until restarted","analyst_note":"","how_to_check":"- Run `asterisk -rx \"module show like ooh323\"` to see whether chan_ooh323 is loaded\n- Check for chan_ooh323.so in the Asterisk modules directory (`ls /usr/lib/asterisk/modules | grep ooh323`)\n- Confirm the H.323 listener port is reachable from the internet","needs_analyst":false,"not_affected_if":["default-config","chan_ooh323-not-installed","h323-port-not-public"],"who_is_affected":"Only systems where the chan_ooh323 addon driver was explicitly compiled and installed, since it is not a default build, and whose H.323 port is publicly reachable. Deployments without chan_ooh323, or with it kept off the public internet, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":3488,"output_tokens":659,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57184':13A,16A '20.20.1':85C,159C '20.7':92C,166C '21.12.3':86C,160C '22.10.1':87C,161C '22.8':94C,168C '23.4.1':88C,162C 'addon':132C 'allow':117C 'asterisk':1A,17B,38B,51B,71C,84C,91C,123C,158C,165C 'attack':49B,120C 'bound':28B,97C,113C 'branch':77C 'care':125C 'cert11':93C,167C 'cert3':95C,169C 'certifi':90C,164C 'chan':9A,40B,101C,130C 'channel':43B,133C 'check':98C 'code':63B 'compil':138C 'craft':2A,53B,126C 'crash':6A,50B,122C 'cve':11A,14A 'default':145C 'denial':59B 'driver':44B,134C 'element':35B,106C 'exchang':78C 'execut':64B 'explicit':137C 'far':66B 'fix':156C 'h.323':3A,42B 'host':21B 'impact':57B 'inform':34B,105C 'information-el':33B,104C 'instal':140C 'insuffici':96C 'issu':154C 'let':45B 'may':116C 'must':135C,149C 'ooh323':10A,41B,102C,131C 'open':74C 'out-of-bound':25B,110C 'packag':18B 'packet':5A,55B,128C 'parser':36B,107C 'permit':108C 'port':148C 'prior':82C 'privat':76C 'public':151C 'q.931':32B,103C 'reachabl':152C 'read':29B,114C 'remot':48B 'self':20B 'self-host':19B 'server':7A 'servic':61B 'setup':4A,54B,127C 'sourc':69B,75C 'state':70B 'telephoni':22B,80C 'toolkit':81C 'unauthent':47B,119C 'use':124C 'via':8A 'voip':23B","nicknames":[],"mitigations":[],"who_affected":"Only systems where the chan_ooh323 addon driver was explicitly compiled and installed, since it is not a default build, and whose H.323 port is publicly reachable. Deployments without chan_ooh323, or with it kept off the public internet, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57184","severity":null,"published_at":"2026-10-26T20:17:56+00:00","modified_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}