CVE-2026-57184
Received Received - Intake

Out-of-Bounds Read in Asterisk chan_ooh323 Q.931 Parser

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-57184
EUVD
EUVD-2026-110305

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
asterisk asterisk < 20.20.1
asterisk asterisk >= 21.0.0-pre1, < 21.12.3
asterisk asterisk >= 22.0.0-pre1, < 22.10.1
asterisk asterisk >= 23.0.0-pre1, < 23.4.1
asterisk certified-asterisk < 20.7-cert11
asterisk certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57184 is an out-of-bounds read vulnerability in Asterisk's chan_ooh323 addon. It occurs in the Q.931 Information Element Parser when processing specially crafted setup packets. The vulnerability stems from insufficient bounds checking in the ooQ931Decode function, allowing an unauthenticated attacker to crash Asterisk by sending malformed Q.931 protocol data.

Detection Guidance

Detecting this vulnerability requires checking if the chan_ooh323 addon is installed and its port is exposed. Inspect Asterisk configuration files for chan_ooh323 settings. Monitor network traffic for malformed Q.931 setup packets targeting the ooh323 port. Use packet capture tools like tcpdump to analyze incoming packets on the ooh323 port.

Impact Analysis

This vulnerability can cause Asterisk to crash, leading to denial of service. It requires the chan_ooh323 addon to be compiled, installed, and have a publicly reachable port. Successful exploitation does not allow code execution or data access but disrupts telephony services.

Mitigation Strategies
  • Upgrade Asterisk to patched versions: 20.20.1, 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 20.7-cert11, 22.8-cert3.
  • Disable or remove the chan_ooh323 addon if not required, as it is not enabled by default.
  • Restrict network access to the ooh323 port using firewalls to prevent unauthenticated attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart