Live › vulnerability › CVE-2026-57186
Go to dashboardA malformed Q.931 element sent to the chan_ooh323 H.323 channel driver makes Asterisk crash, because a fix for an earlier CVE was never carried forward to newer releases. The impact is denial of service, not code execution, as far as the sources state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 22:29 UTC. All times on this page are UTC.
Only systems that build and install the non-default chan_ooh323 addon driver and expose its H.323 port publicly are exposed. Deployments on Asterisk 20 or without chan_ooh323 installed can skip it.
No product ranges from the sources yet.
asterisk -V and compare against the fixed versions.asterisk -rx "module show like ooh323".21.12.3 or later.22.10.1 or later.23.4.1 or later.22.8-cert3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57186")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.