---
id: "CVE-2026-57184"
kind: "vulnerability"
aliases: ["CVE-2026-57184"]
title: "Asterisk: crafted H.323 setup packet crashes server via chan_ooh323"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asterisk", "package", "self-hosted", "telephony", "voip"]
not_affected_if: ["chan_ooh323-not-installed", "default-config", "h323-port-not-public"]
published_at: "2026-10-26T20:17:56+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57184", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# Asterisk: crafted H.323 setup packet crashes server via chan_ooh323

An out-of-bounds read in the Q.931 information-element parser of Asterisk's chan_ooh323 H.323 channel driver lets an unauthenticated remote attacker crash Asterisk with crafted setup packets. The impact is denial of service, not code execution, as far as the sources state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `asterisk -rx "module show like ooh323"` to see whether chan_ooh323 is loaded
- Check for chan_ooh323.so in the Asterisk modules directory (`ls /usr/lib/asterisk/modules | grep ooh323`)
- Confirm the H.323 listener port is reachable from the internet

## Fix

- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`
- Upgrade Certified Asterisk to `20.7-cert11` or `22.8-cert3`
- If chan_ooh323 is not needed, remove or unload it and block the H.323 port at the firewall

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57184

## From the sources

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_