Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M
CVE-2026-57186Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
High 7.5
In plain English
A high-severity security flaw in asterisk from asterisk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | asterisk | 1:22.10.1+dfsg+~cs6.17.60671434-1 | DEBIAN-CVE-2026-57186 |
| Ubuntu:22.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57186 |
| Ubuntu:24.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57186 |
| Ubuntu:26.04:LTS | asterisk | no fix listed | UBUNTU-CVE-2026-57186 |
| Ubuntu:26.10 | asterisk | no fix listed | UBUNTU-CVE-2026-57186 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| asterisk | asterisk | >= 21.0.0-pre1, < 21.12.3>= 22.0.0-pre1, < 22.10.1>= 23.0.0-pre1, < 23.4.1 |
| asterisk | certified-asterisk | >= 22.8-cert1-pre1, < 22.8-cert3 |
Weakness: CWE-839 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/asterisk/asterisk/security/advisories/GHSA-h5hv-jmgj-92q2 x_refsource_CONFIRM
- https://github.com/asterisk/asterisk/commit/07b9740cbc371ffa7936cf368089fd073250ea7c x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/0e776a837106d5d0d14503a53388337931045164 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/42d3552d2ac0efbb68c9ec7ade898b6de0bfa033 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/46c6c652d1de9bfbb061fab0b1f681cf60660998 x_refsource_MISC
- https://github.com/asterisk/asterisk/commit/62a7a7037b1a145cabf95895b119cbae4d3c5a4f x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/21.12.3 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/22.10.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/23.4.1 x_refsource_MISC
- https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 x_refsource_MISC
- https://github.com/asterisk/asterisk/tree/24.0.0-pre1 x_refsource_MISC