CVE-2026-57186

Received Received - Intake

Denial of Service in Asterisk via Q.931 Parser

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-57186

EUVD

EUVD-2026-111395

Affected Vendors & Products

Vendor	Product	Version / Range
asterisk	asterisk	>= 21.0.0-pre1, < 21.12.3
asterisk	asterisk	>= 22.0.0-pre1, < 22.10.1
asterisk	asterisk	>= 23.0.0-pre1, < 23.4.1
asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-839	The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

Attack-Flow Graph

Executive Summary

This vulnerability affects Asterisk, a telephony toolkit, where the chan_ooh323 Q.931 party-number parser lacks a previous fix (CVE-2022-37325). Malformed Q.931 elements in an OOH323 request can crash Asterisk. The issue impacts versions after 20 and requires the chan_ooh323 addon to be compiled, installed, and publicly reachable.

Detection Guidance

Check if chan_ooh323 is compiled and installed by running 'module show like chan_ooh323' in the Asterisk CLI. Verify if the OOH323 port is publicly reachable using network scanning tools like nmap on the expected port (default 1720).

Impact Analysis

This vulnerability can cause Asterisk to crash when processing malformed OOH323 requests. If exploited, it may lead to denial-of-service (DoS) conditions, disrupting telephony services. The impact is limited to systems using the chan_ooh323 addon with public reachability.

Mitigation Strategies

Upgrade Asterisk to version 21.12.3, 22.10.1, 23.4.1, or Certified Asterisk 22.8-cert3 or later. If using chan_ooh323, ensure it is not exposed to untrusted networks by blocking the port at the firewall level.

Hi! I’m here to help you understand CVE-2026-57186. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70